CVE-2020-20296

CRITICAL

cmswing 1.3.8 - SQL Injection via Recharge Action

Title source: llm
STIX 2.1

Description

An issue was found in CMSWing project version 1.3.8, Because the rechargeAction function does not check the balance parameter, malicious parameters can execute arbitrary SQL commands.

References (1)

Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://github.com/arterli/CmsWing/issues/51

Scores

CVSS v3 9.8
EPSS 0.0135
EPSS Percentile 68.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-89
Status published
Products (1)
cmswing/cmswing 1.3.8
Published Feb 01, 2021
Tracked Since Feb 18, 2026