CVE-2020-36631

Katalog CVE

CVSS 9.8 · Critical EPSS 0,71%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada dwc network server emulator project dwc network server emulator. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

A vulnerability was found in barronwaffles dwc_network_server_emulator. It has been declared as critical. This vulnerability affects the function update_profile of the file gamespy/gs_database.py. The manipulation of the argument firstname/lastname leads to sql injection. The attack can be initiated remotely. The name of the patch is f70eb21394f75019886fbc2fb536de36161ba422. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216772.

Rincian

Terbit di NVD

25 Desember 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

0,71% peluang dieksploitasi; lebih tinggi dari 52,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/barronwaffles/dwc_network_server_emulator/commit/f70eb21394f75019886fbc2fb536de36161ba422 patch · advisory pihak ketiga
• https://github.com/barronwaffles/dwc_network_server_emulator/pull/538 patch · advisory pihak ketiga
• https://vuldb.com/?ctiid.216772 advisory pihak ketiga
• https://vuldb.com/?id.216772 advisory pihak ketiga