Unscored CVE-2020-14027 EUVD-2020-6193GHSA-53ph-mcf9-r8mc

An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The database connection strings accept custom unsafe arguments, such as ENA…

Published Sep 22, 2020 · Updated Aug 4, 2024 · Assigned by mitre

Description

An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The database connection strings accept custom unsafe arguments, such as ENABLE_LOCAL_INFILE, that can be leveraged by attackers to enable MySQL Load Data Local (rogue MySQL server) attacks.

References

http://www.ozeki.hu/index.php?owpn=231
https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-14027-MySQL%20LOAD%20DATA%20LOCAL%20INFILE%20Attack-Ozeki%20SMS%20Gateway