CVE-2020-15886 | BDVDB-2026-139402 Detail

Description#

A SQL injection vulnerability in reportdata_controller.php in the reportdata module before 3.5 for MunkiReport allows attackers to execute arbitrary SQL commands via the req parameter of the /module/reportdata/ip endpoint.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://github.com/munkireport/munkireport-php/releases
https://github.com/munkireport/reportdata/releases
https://github.com/munkireport/munkireport-php/releases/tag/v5.6.3
https://github.com/munkireport/munkireport-php/wiki/20200722-SQL-Injection-In-Reportdata-Ip-In-%27req%27-GET-Parameter

Exploit#

No public exploit known

History#

Version 12020-07-23Record published in the CVE List.
Version 22024-08-04Most recent update recorded in the CVE List.