cnvd - cnvd-2020-24023

cnvd-2020-24023

Vulnerability from cnvd

Title: Leantime sql注入漏洞

Description:

Leantime Systems Leantime是美国Leantime Systems公司的一套基于PHP和MySQL的开源项目管理系统。

Leantime 2.0.15之前版本和2.1-beta3之前版本中存在SQL注入漏洞。攻击者可利用该漏洞执行任意的SQL语句，获取数据（例如用户和管理员哈希密码），修改数据或删除表单，影响网站的完整性、保密性和可用性。

Severity: 高

Patch Name: Leantime sql注入漏洞的补丁

Patch Description:

Leantime Systems Leantime是美国Leantime Systems公司的一套基于PHP和MySQL的开源项目管理系统。

Leantime 2.0.15之前版本和2.1-beta3之前版本中存在SQL注入漏洞。攻击者可利用该漏洞执行任意的SQL语句，获取数据（例如用户和管理员哈希密码），修改数据或删除表单，影响网站的完整性、保密性和可用性。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://github.com/Leantime/leantime/security/advisories/GHSA-ww6x-rhvp-55hp

Impacted products

Name
['Leantime Systems Leantime <2.0.15', 'Leantime Systems Leantime <2.1-beta3']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-5292"
    }
  },
  "description": "Leantime Systems Leantime\u662f\u7f8e\u56fdLeantime Systems\u516c\u53f8\u7684\u4e00\u5957\u57fa\u4e8ePHP\u548cMySQL\u7684\u5f00\u6e90\u9879\u76ee\u7ba1\u7406\u7cfb\u7edf\u3002\n\nLeantime 2.0.15\u4e4b\u524d\u7248\u672c\u548c2.1-beta3\u4e4b\u524d\u7248\u672c\u4e2d\u5b58\u5728SQL\u6ce8\u5165\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u6267\u884c\u4efb\u610f\u7684SQL\u8bed\u53e5\uff0c\u83b7\u53d6\u6570\u636e\uff08\u4f8b\u5982\u7528\u6237\u548c\u7ba1\u7406\u5458\u54c8\u5e0c\u5bc6\u7801\uff09\uff0c\u4fee\u6539\u6570\u636e\u6216\u5220\u9664\u8868\u5355\uff0c\u5f71\u54cd\u7f51\u7ad9\u7684\u5b8c\u6574\u6027\u3001\u4fdd\u5bc6\u6027\u548c\u53ef\u7528\u6027\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://github.com/Leantime/leantime/security/advisories/GHSA-ww6x-rhvp-55hp",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-24023",
  "openTime": "2020-04-21",
  "patchDescription": "Leantime Systems Leantime\u662f\u7f8e\u56fdLeantime Systems\u516c\u53f8\u7684\u4e00\u5957\u57fa\u4e8ePHP\u548cMySQL\u7684\u5f00\u6e90\u9879\u76ee\u7ba1\u7406\u7cfb\u7edf\u3002\r\n\r\nLeantime 2.0.15\u4e4b\u524d\u7248\u672c\u548c2.1-beta3\u4e4b\u524d\u7248\u672c\u4e2d\u5b58\u5728SQL\u6ce8\u5165\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u6267\u884c\u4efb\u610f\u7684SQL\u8bed\u53e5\uff0c\u83b7\u53d6\u6570\u636e\uff08\u4f8b\u5982\u7528\u6237\u548c\u7ba1\u7406\u5458\u54c8\u5e0c\u5bc6\u7801\uff09\uff0c\u4fee\u6539\u6570\u636e\u6216\u5220\u9664\u8868\u5355\uff0c\u5f71\u54cd\u7f51\u7ad9\u7684\u5b8c\u6574\u6027\u3001\u4fdd\u5bc6\u6027\u548c\u53ef\u7528\u6027\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Leantime sql\u6ce8\u5165\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Leantime Systems Leantime \u003c2.0.15",
      "Leantime Systems Leantime \u003c2.1-beta3"
    ]
  },
  "serverity": "\u9ad8",
  "submitTime": "2020-04-01",
  "title": "Leantime sql\u6ce8\u5165\u6f0f\u6d1e"
}

CVE-2020-5292 (GCVE-0-2020-5292)

Vulnerability from cvelistv5

Published

2020-03-31 18:15

Modified

2024-08-04 08:22

Severity ?

8.7 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

CWE

CWE-89 - - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Summary

Leantime before versions 2.0.15 and 2.1-beta3 has a SQL Injection vulnerability. The impact is high. Malicious users/attackers can execute arbitrary SQL queries negatively affecting the confidentiality, integrity, and availability of the site. Attackers can exfiltrate data like the users' and administrators' password hashes, modify data, or drop tables. The unescaped parameter is "searchUsers" when sending a POST request to "/tickets/showKanban" with a valid session. In the code, the parameter is named "users" in class.tickets.php. This issue is fixed in versions 2.0.15 and 2.1.0 beta 3.

References

▼	URL	Tags
	https://github.com/Leantime/leantime/security/advisories/GHSA-ww6x-rhvp-55hp	x_refsource_CONFIRM
	https://github.com/Leantime/leantime/pull/181	x_refsource_MISC
	https://github.com/Leantime/leantime/commit/af0807f0b2c4c3c914b93f1c5d940e6b875f231f	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	Leantime	Leantime	Version: < 2.0.15

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T08:22:09.190Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/Leantime/leantime/security/advisories/GHSA-ww6x-rhvp-55hp"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/Leantime/leantime/pull/181"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/Leantime/leantime/commit/af0807f0b2c4c3c914b93f1c5d940e6b875f231f"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Leantime",
          "vendor": "Leantime",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.0.15"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Leantime before versions 2.0.15 and 2.1-beta3 has a SQL Injection vulnerability. The impact is high. Malicious users/attackers can execute arbitrary SQL queries negatively affecting the confidentiality, integrity, and availability of the site. Attackers can exfiltrate data like the users\u0027 and administrators\u0027 password hashes, modify data, or drop tables. The unescaped parameter is \"searchUsers\" when sending a POST request to \"/tickets/showKanban\" with a valid session. In the code, the parameter is named \"users\" in class.tickets.php. This issue is fixed in versions 2.0.15 and 2.1.0 beta 3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 - Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-03-31T18:15:15",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Leantime/leantime/security/advisories/GHSA-ww6x-rhvp-55hp"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Leantime/leantime/pull/181"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Leantime/leantime/commit/af0807f0b2c4c3c914b93f1c5d940e6b875f231f"
        }
      ],
      "source": {
        "advisory": "GHSA-ww6x-rhvp-55hp",
        "discovery": "UNKNOWN"
      },
      "title": "Time-based blind injection in Leantime",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2020-5292",
          "STATE": "PUBLIC",
          "TITLE": "Time-based blind injection in Leantime"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Leantime",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 2.0.15"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Leantime"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Leantime before versions 2.0.15 and 2.1-beta3 has a SQL Injection vulnerability. The impact is high. Malicious users/attackers can execute arbitrary SQL queries negatively affecting the confidentiality, integrity, and availability of the site. Attackers can exfiltrate data like the users\u0027 and administrators\u0027 password hashes, modify data, or drop tables. The unescaped parameter is \"searchUsers\" when sending a POST request to \"/tickets/showKanban\" with a valid session. In the code, the parameter is named \"users\" in class.tickets.php. This issue is fixed in versions 2.0.15 and 2.1.0 beta 3."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-89 - Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/Leantime/leantime/security/advisories/GHSA-ww6x-rhvp-55hp",
              "refsource": "CONFIRM",
              "url": "https://github.com/Leantime/leantime/security/advisories/GHSA-ww6x-rhvp-55hp"
            },
            {
              "name": "https://github.com/Leantime/leantime/pull/181",
              "refsource": "MISC",
              "url": "https://github.com/Leantime/leantime/pull/181"
            },
            {
              "name": "https://github.com/Leantime/leantime/commit/af0807f0b2c4c3c914b93f1c5d940e6b875f231f",
              "refsource": "MISC",
              "url": "https://github.com/Leantime/leantime/commit/af0807f0b2c4c3c914b93f1c5d940e6b875f231f"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-ww6x-rhvp-55hp",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2020-5292",
    "datePublished": "2020-03-31T18:15:15",
    "dateReserved": "2020-01-02T00:00:00",
    "dateUpdated": "2024-08-04T08:22:09.190Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted