« Volver al listado

CVE-2020-8520

Estado: ModificadaCrítica (9.8)—

Una inyección SQL en los parámetros order y column del archivo Records.php para phpzag live agregar editar eliminar registros de tablas de datos con ajax php mysql

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Phpzag — Phpzag

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-8520",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "larry0@me.com",
      "affectedData": [
        {
          "vendor": "phpzag",
          "product": "phpzag live add edit delete data tables records with ajax php mysql",
          "versions": [
            {
              "status": "affected",
              "version": "1.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-07-07T20:15:10.277",
  "references": [
    {
      "url": "http://www.openwall.com/lists/oss-security/2020/07/09/1",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "larry0@me.com"
    },
    {
      "url": "http://www.vapidlabs.com/advisory.php?v=213",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "larry0@me.com"
    },
    {
      "url": "https://www.phpzag.com/live-add-edit-delete-datatables-records-with-ajax-php-mysql/",
      "tags": [
        "Product",
        "Vendor Advisory"
      ],
      "source": "larry0@me.com"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2020/07/09/1",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vapidlabs.com/advisory.php?v=213",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.phpzag.com/live-add-edit-delete-datatables-records-with-ajax-php-mysql/",
      "tags": [
        "Product",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SQL injection in order and column parameters in Records.php for phpzag live add edit delete data tables records with ajax php mysql"
    },
    {
      "lang": "es",
      "value": "Una inyección SQL en los parámetros order y column del archivo Records.php para phpzag live agregar editar eliminar registros de tablas de datos con ajax php mysql"
    }
  ],
  "lastModified": "2026-06-17T03:26:30.710",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:phpzag:phpzag:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "48F1CDD1-16F1-41FF-B4A3-B147EA06000C"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "larry0@me.com"
}