Description
A SQL injection vulnerability in reportdata_controller.php in the reportdata module before 3.5 for MunkiReport allows attackers to execute arbitrary SQL commands via the req parameter of the /module/reportdata/ip endpoint.
References (4)
Core 4
Core References
Release Notes, Third Party Advisory x_refsource_misc
https://github.com/munkireport/munkireport-php/releases
Release Notes, Third Party Advisory x_refsource_misc
https://github.com/munkireport/reportdata/releases
Release Notes, Third Party Advisory x_refsource_misc
https://github.com/munkireport/munkireport-php/releases/tag/v5.6.3
Third Party Advisory x_refsource_misc
https://github.com/munkireport/munkireport-php/wiki/20200722-SQL-Injection-In-Reportdata-Ip-In-%27req%27-GET-Parameter
Scores
CVSS v3
8.8
EPSS
0.0126
EPSS Percentile
66.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-89
Status
published
Products (2)
munkireport/reportdata
0 - 3.5Packagist
reportdata_project/reportdata
< 3.5
Published
Jul 23, 2020
Tracked Since
Feb 18, 2026