Vulnerability · Published Sep 30, 2020 · Assigned by mitre
CVE-2020-15849
High 7.2
In plain English
A high-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.7% (higher than 86% of all known vulnerabilities).
Official description
Re:Desk 2.3 has a blind authenticated SQL injection vulnerability in the SettingsController class, in the actionEmailTemplates() method. A malicious actor with access to an administrative account could abuse this vulnerability to recover sensitive data from the application's database, allowing for authorization bypass and taking over additional accounts by means of modifying password-reset tokens stored in the database. Remote command execution is also possible by leveraging this to abuse the Yii framework's bizRule functionality, allowing for arbitrary PHP code to be executed by the application. Remote command execution is also possible by using this together with a separate insecure file upload vulnerability (CVE-2020-15488).
Affected products (as reported)
References
- https://www.re-desk.com/download-help-desk-software.html x_refsource_MISC
- https://labs.f-secure.com/advisories/redesk-v2-3-multiple-issues/ x_refsource_MISC