Unscored CVE-2020-28860 EUVD-2020-21252GHSA-7q5m-m6v8-m536

OpenAssetDigital Asset Management (DAM) through 12.0.19 does not correctly sanitize user supplied input, incorporating it into its SQL quer…

Published Dec 14, 2020 · Updated Jul 9, 2026 · Assigned by mitre

Description

OpenAssetDigital Asset Management (DAM) through 12.0.19 does not correctly sanitize user supplied input, incorporating it into its SQL queries, allowing for authenticated blind SQL injection.

References

20201211 Authenticated blind SQL injection (SQLi) in OpenAsset Digital Asset Management 11.2.1/12.0.19 disclosure mailing-list
http://packetstormsecurity.com/files/160459/OpenAsset-Digital-Asset-Management-SQL-Injection.html
https://www.themissinglink.com.au/security-advisories-cve-2020-28860