Back to overview

CVE-2020-8967

CRITICAL
10.0
CVSS 3.1
Description
There is an improper Neutralization of Special Elements used in an SQL Command (SQL Injection) vulnerability in php files of GESIO ERP. GESIO ERP all versions prior to 11.2 allows malicious users to retrieve all database information.

Metadata

CVE ID
CVE-2020-8967
State
PUBLISHED
Assigner
INCIBE
Reserved
2020-02-13 00:00 UTC
Published
2020-06-01 13:05 UTC
Last updated
2024-09-16 16:42 UTC
Primary CWE
CWE-89
CWE-89 Improper Neutralization of Special Elements used in a…
Vendor / Product
Gesio (GESTIÓN INTEGRAL ONLINE, SL) / GESIO ERP
Sources
cve.org  ·  NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products (1)
VendorProductPlatformVersions
Gesio (GESTIÓN INTEGRAL ONLINE, SL) GESIO ERP — 11.2 < 11.2
Weakness (CWE)
CWESourceDescription
CWE-89 cna CWE-89 Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)
CVSS scores (1)
ScoreSeverityVersionSourceVector
10.0 CRITICAL 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References (1)
Back to overview