CVE-2020-35674

BigProf Online Invoicing System before 2.9 suffers from an unauthenticated SQL Injection found in /membership_passwordReset.php (the endpoint that is responsible for issuing self-service password resets). An unauthenticated attacker is able to send a request containing a crafted payload that can result in sensitive information being extracted from the database, eventually leading into an application takeover. This vulnerability was introduced as a result of the developer trying to roll their own sanitization implementation in order to allow the application to be used in legacy environments.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://labs.ingredous.com/2020/07/13/ois-sqli/	Broken Link
https://labs.ingredous.com/2020/07/13/ois-sqli/	Broken Link

Configurations

Configuration 1 (hide)

cpe:2.3:a:bigprof:online_invoicing_system:*:*:*:*:*:*:*:*

History

21 Nov 2024, 05:27

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-09-29 03:15

Updated : 2024-11-21 05:27

NVD link : CVE-2020-35674

Mitre link : CVE-2020-35674

CVE.ORG link : CVE-2020-35674

JSON object : View

Products Affected

bigprof

online_invoicing_system

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2020-35674", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2022-09-29T03:15:14.130", "references": [{"url": "https://labs.ingredous.com/2020/07/13/ois-sqli/", "tags": ["Broken Link"], "source": "cve@mitre.org"}, {"url": "https://labs.ingredous.com/2020/07/13/ois-sqli/", "tags": ["Broken Link"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "BigProf Online Invoicing System before 2.9 suffers from an unauthenticated SQL Injection found in /membership_passwordReset.php (the endpoint that is responsible for issuing self-service password resets). An unauthenticated attacker is able to send a request containing a crafted payload that can result in sensitive information being extracted from the database, eventually leading into an application takeover. This vulnerability was introduced as a result of the developer trying to roll their own sanitization implementation in order to allow the application to be used in legacy environments."}, {"lang": "es", "value": "BigProf Online Invoicing System versiones anteriores a 2.9, sufre una inyecci\u00f3n SQL no autenticada encontrada en el archivo/membership_passwordReset.php (el endpoint que es responsable de emitir restablecimientos de contrase\u00f1a de autoservicio). Un atacante no autenticado puede enviar una petici\u00f3n que contenga un payload dise\u00f1ado que puede resultar en una extracci\u00f3n de informaci\u00f3n confidencial de la base de datos, conllevando eventualmente a una toma de control de la aplicaci\u00f3n. Esta vulnerabilidad fue introducida como resultado de que el desarrollador trat\u00f3 de implementar su propio saneo para permitir que la aplicaci\u00f3n sea usada en entornos heredados"}], "lastModified": "2024-11-21T05:27:48.863", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bigprof:online_invoicing_system:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0BE075C3-49B6-4695-871E-6F9AB830F5EC", "versionEndExcluding": "2.9"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}