Vulnerability · Published Aug 17, 2021 · Assigned by talos

CVE-2020-13589

Medium 5.4

In plain English

A medium-severity SQL injection in Rukovoditel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities).

Severity (CVSS 3.0)5.4Medium

Exploit odds (30 days)1.0%top 38.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

An exploitable SQL injection vulnerability exists in the ‘entities/fields’ page of the Rukovoditel Project Management App 2.7.2. The entities_id parameter in the 'entities/fields page (mulitple_edit or copy_selected or export function) is vulnerable to authenticated SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability, this can be done either with administrator credentials or through cross-site request forgery.

Affected products (as reported)

Vendor	Product	Versions
n/a	Rukovoditel	Rukovoditel Project Management App 2.7.2

Weakness: CWE-89 · Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

References

https://talosintelligence.com/vulnerability_reports/TALOS-2020-1199 x_refsource_MISC