~ / search / GHSA-4qgh-m9vp-48xp

GHSA-4qgh-m9vp-48xp

MunkiReport Software Update module is vulnerable to SQL injection

Source: GitHub Advisory Database (reviewed) High CVE-2020-15887

Packages

EcosystemPackageAffectedFixed in
Packagist munkireport/softwareupdate < 1.6 1.6

Details

As written in the advisory (Markdown source, shown as plain text).

A SQL injection vulnerability in softwareupdate_controller.php in the Software Update module before 1.6 for MunkiReport allows attackers to execute arbitrary SQL commands via the last URL parameter of the `/module/softwareupdate/get_tab_data/` endpoint.

References

External links from the advisory. They lead to third-party sites.