CVE-2020-8967

GESIO SQL injection vulnerability

CVSS 10 CRITICALEPSS 1.0%CWE-89

Vexday Risk Score

28Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 10EPSS 1.0%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

01 Jun 2020Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

There is an improper Neutralization of Special Elements used in an SQL Command (SQL Injection) vulnerability in php files of GESIO ERP. GESIO ERP all versions prior to 11.2 allows malicious users to retrieve all database information.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

Gesio (GESTIÓN INTEGRAL ONLINE, SL) · GESIO ERP

References

https://www.incibe-cert.es/en/early-warning/security-advisories/gesio-sql-injection-vulnerability