CVE-2020-28860

HighCVSS 8.8/10Last modified Jul 9, 2026

Description

OpenAssetDigital Asset Management (DAM) through 12.0.19 does not correctly sanitize user supplied input, incorporating it into its SQL queries, allowing for authenticated blind SQL injection.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/160459/OpenAsset-Digital-Asset-Management-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2020/Dec/21Exploit, Mailing List, Third Party Advisory
https://www.themissinglink.com.au/security-advisories-cve-2020-28860Third Party Advisory
http://packetstormsecurity.com/files/160459/OpenAsset-Digital-Asset-Management-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2020/Dec/21Exploit, Mailing List, Third Party Advisory
https://www.themissinglink.com.au/security-advisories-cve-2020-28860Third Party Advisory

Timeline

Published: Dec 14, 2020
Last modified: Jul 9, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-288615.3OpenAsset Digital Asset Management (DAM) 12.0.19 and earlier failed to implement access controls on /Stream/ProjectsCSV endpoint, allowing u CVE-2020-288649.8Buffer overflow in WinSCP 5.17.8 allows a malicious FTP server to cause a denial of service or possibly have other unspecified impact via a CVE-2020-288657.5An issue was discovered in PowerJob through 3.2.2, allows attackers to change arbitrary user passwords via the id parameter to /appinfo/save CVE-2020-28875.3Vulnerability in the Oracle Customer Interaction History product of Oracle E-Business Suite (component: Outcome-Result). Supported versions CVE-2020-288709.8In InoERP 0.7.2, an unauthorized attacker can execute arbitrary code on the server side due to lack of validations in /modules/sys/form_pers CVE-2020-288719.8Remote code execution in Monitorr v1.7.6m in upload.php allows an unauthorized person to execute arbitrary code on the server-side via an in CVE-2020-288729.8An authorization bypass vulnerability in Monitorr v1.7.6m in Monitorr/assets/config/_installation/_register.php allows an unauthorized perso CVE-2020-288737.5Fluxbb 1.5.11 is affected by a denial of service (DoS) vulnerability by sending an extremely long password via the user login form. When a l CVE-2020-288747.5reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic. Errors are n CVE-2020-288779.8Buffer overflow in in the copy_msg_element function for the devDiscoverHandle server in the TP-Link WR and WDR series, including WDR7400, WD CVE-2020-28885.3Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Partners). Supported versions that are affected are 12.CVE-2020-288847.2Liferay Portal Server tested on 7.3.5 GA6, 7.2.0 GA1 is affected by OS Command Injection. An administrator user can inject Groovy script to