CVE-2020-20295

CRITICAL

cmswing 1.3.8 - SQL Injection via updateAction detail parameter

Title source: llm
STIX 2.1

Description

An issue was found in CMSWing project version 1.3.8. Because the updateAction function does not check the detail parameter, malicious parameters can execute arbitrary SQL commands.

References (1)

Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://github.com/arterli/CmsWing/issues/50

Scores

CVSS v3 9.8
EPSS 0.0135
EPSS Percentile 68.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-89
Status published
Products (1)
cmswing/cmswing 1.3.8
Published Feb 01, 2021
Tracked Since Feb 18, 2026