QwikSec

Security Database

CVE

CWE

Training

CVE-2020-26124

Published: Oct 2, 2020

Modified: Aug 4, 2024

PUBLISHED

Description

openmediavault before 4.1.36 and 5.x before 5.5.12 allows authenticated PHP code injection attacks, via the sortfield POST parameter of rpc.php, because json_encode_safe is not used in config/databasebackend.inc. Successful exploitation allows arbitrary command execution on the underlying operating system as root.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

https://github.com/openmediavault/openmediavault/commit/ebb51bbf5a39f4955eab0073bf87f2a31926d85d

x_refsource_MISC

https://www.openmediavault.org/?p=2797

x_refsource_CONFIRM

http://packetstormsecurity.com/files/160223/OpenMediaVault-rpc.php-Authenticated-PHP-Code-Injection.html

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

CVE-2020-26124 - Security Vulnerability | QwikSec