SQL injection in Logon Page in MV's mConnect application, v02.001.00, allows an attacker to use a non existing user with a generic password to connect to the application and get access to unauthorized information.
References
| Link | Resource |
|---|---|
| https://github.com/ifmacedo/mconnect/blob/main/SQLinjection | Exploit Third Party Advisory |
| https://www.linkedin.com/pulse/mconnect-mv-sql-injection-parcial-iran/ | Third Party Advisory |
| https://github.com/ifmacedo/mconnect/blob/main/SQLinjection | Exploit Third Party Advisory |
| https://www.linkedin.com/pulse/mconnect-mv-sql-injection-parcial-iran/ | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 05:13
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/ifmacedo/mconnect/blob/main/SQLinjection - Exploit, Third Party Advisory | |
| References | () https://www.linkedin.com/pulse/mconnect-mv-sql-injection-parcial-iran/ - Third Party Advisory |
30 Jul 2021, 13:58
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:mv:mconnect:2013.1.6.8:*:*:*:*:*:*:* cpe:2.3:a:mv:mconnect:02.001.00:*:*:*:*:*:*:* |
|
| CWE | CWE-89 | |
| CVSS |
v2 : v3 : |
v2 : 5.0
v3 : 7.5 |
| References | (MISC) https://github.com/ifmacedo/mconnect/blob/main/SQLinjection - Exploit, Third Party Advisory | |
| References | (MISC) https://www.linkedin.com/pulse/mconnect-mv-sql-injection-parcial-iran/ - Third Party Advisory |
21 Jul 2021, 15:21
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-07-21 15:15
Updated : 2024-11-21 05:13
NVD link : CVE-2020-23282
Mitre link : CVE-2020-23282
CVE.ORG link : CVE-2020-23282
JSON object : View
Products Affected
mv
- mconnect
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')