CVE-2020-26944

CRITICAL

Aptean Product Configurator <4.61.0000 - SQL Injection

Title source: llm

Description

An issue was discovered in Aptean Product Configurator 4.61.0000 on Windows. A Time based SQL injection affects the nameTxt parameter on the main login page (aka cse?cmd=LOGIN). This can be exploited directly, and remotely.

References (2)

Core 2

Core References

Vendor Advisory x_refsource_misc

https://www.aptean.com

Exploit, Third Party Advisory x_refsource_misc

https://www.logicallysecure.com/blog/sql-injection-in-aptean/

Scores

CVSS v3 9.8

EPSS 0.0115

EPSS Percentile 63.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-89

Status published

Products (1)

aptean/product_configurator 4.61.0000

Published Oct 16, 2020

Tracked Since Feb 18, 2026