Paper/Archive/CVE-2020-36631

CVE-2020-36631

barronwaffles dwc_network_server_emulator — barronwaffles dwc_network_server_emulator gs_database.py update_profile sql injection

EPSS 0.7%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 54.5.545 × 2010.9 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

A vulnerability was found in barronwaffles dwc_network_server_emulator. It has been declared as critical. This vulnerability affects the function update_profile of the file gamespy/gs_database.py. The manipulation of the argument firstname/lastname leads to sql injection. The attack can be initiated remotely. The name of the patch is f70eb21394f75019886fbc2fb536de36161ba422. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216772.

Affected

ProductAffectedFixed inSource

dwc_network_server_emulatorn/a–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

VulDB (CNA)6.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

VulDB (CNA)6.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

writeupvuldb.com/?id.216772 refvuldb.com/?ctiid.216772 refgithub.com/barronwaffles/dwc_network_server_emulator/pull/538 patchgithub.com/barronwaffles/dwc_network_server_emulator/commit/f70eb21394f75019886fbc2fb536de36161ba422