Vulnerability Details CVE-2020-26525
Damstra Smart Asset 2020.7 has SQL injection via the API/api/Asset originator parameter. This allows forcing the database and server to initiate remote connections to third party DNS servers.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.268
EPSS Ranking 96.1%
CVSS Severity
CVSS v3 Score 9.1
CVSS v2 Score 6.4
References
- https://github.com/lukaszstu/SmartAsset-SQLinj-CVE-2020-26525/blob/main/README.md
- https://support.damstratechnology.com/hc/en-us/categories/900000115446-SmartAsset-Damstra-Asset-Management-Platform
- https://www.smartasset.com.au/
- https://github.com/lukaszstu/SmartAsset-SQLinj-CVE-2020-26525/blob/main/README.md
- https://support.damstratechnology.com/hc/en-us/categories/900000115446-SmartAsset-Damstra-Asset-Management-Platform
- https://www.smartasset.com.au/
Products affected by CVE-2020-26525
-
cpe:2.3:a:damstratechnology:smart_asset:2020.7