CVE-2020-23282

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

SQL injection in Logon Page in MV's mConnect application, v02.001.00, allows an attacker to use a non existing user with a generic password to connect to the application and get access to unauthorized information.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/ifmacedo/mconnect/blob/main/SQLinjectionExploit, Third Party Advisory
https://www.linkedin.com/pulse/mconnect-mv-sql-injection-parcial-iran/Third Party Advisory
https://github.com/ifmacedo/mconnect/blob/main/SQLinjectionExploit, Third Party Advisory
https://www.linkedin.com/pulse/mconnect-mv-sql-injection-parcial-iran/Third Party Advisory

Timeline

Published: Jul 21, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-232837.5Information disclosure in Logon Page in MV's mConnect application v02.001.00 allows an attacker to know valid users from the application's d CVE-2020-232847.5Information disclosure in aspx pages in MV's IDCE application v1.0 allows an attacker to copy and paste aspx pages in the end of the URL app CVE-2020-233029.8There is a heap-use-after-free at ecma-helpers-string.c:772 in ecma_ref_ecma_string in JerryScript 2.2.0 CVE-2020-233039.8There is a heap-buffer-overflow at jmem-poolman.c:165 in jmem_pools_collect_empty in JerryScript 2.2.0.CVE-2020-233069.8There is a stack-overflow at ecma-regexp-object.c:535 in ecma_regexp_match in JerryScript 2.2.0.CVE-2020-233087.5There is an Assertion 'context_p->stack_top_uint8 == LEXER_EXPRESSION_START' at js-parser-expr.c:3565 in parser_parse_expression in JerryScr CVE-2020-233097.5There is an Assertion 'context_p->stack_depth == context_p->context_stack_depth' failed at js-parser-statm.c:2756 in parser_parse_statements CVE-2020-233107.5There is an Assertion 'context_p->next_scanner_info_p->type == SCANNER_TYPE_FUNCTION' failed at js-parser-statm.c:733 in parser_parse_functi CVE-2020-233117.5There is an Assertion 'context_p->token.type == LEXER_RIGHT_BRACE || context_p->token.type == LEXER_ASSIGN || context_p->token.type == LEXER CVE-2020-233127.5There is an Assertion 'context.status_flags & PARSER_SCANNING_SUCCESSFUL' failed at js-parser.c:2185 in parser_parse_source in JerryScript 2 CVE-2020-233137.5There is an Assertion 'scope_stack_p > context_p->scope_stack_p' failed at js-scanner-util.c:2510 in scanner_literal_is_created in JerryScri CVE-2020-233147.5There is an Assertion 'block_found' failed at js-parser-statm.c:2003 parser_parse_try_statement_end in JerryScript 2.2.0.