Description
A SQL injection vulnerability in softwareupdate_controller.php in the Software Update module before 1.6 for MunkiReport allows attackers to execute arbitrary SQL commands via the last URL parameter of the /module/softwareupdate/get_tab_data/ endpoint.
References (4)
Core 4
Core References
Release Notes, Third Party Advisory x_refsource_misc
https://github.com/munkireport/munkireport-php/releases
Release Notes, Third Party Advisory x_refsource_misc
https://github.com/munkireport/softwareupdate/releases
Third Party Advisory x_refsource_misc
https://github.com/munkireport/munkireport-php/wiki/20200722-SQL-Injection-in-softwareupdate-module
Release Notes, Third Party Advisory x_refsource_misc
https://github.com/munkireport/munkireport-php/releases/tag/v5.6.3
Scores
CVSS v3
8.8
EPSS
0.0126
EPSS Percentile
66.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-89
Status
published
Products (2)
munkireport/softwareupdate
0 - 1.6Packagist
softwareupdate_project/softwareupdate
< 1.6
Published
Jul 23, 2020
Tracked Since
Feb 18, 2026