CVE-2020-26525

CRITICAL 9.1CVE-2020-26525 · Published 02/10/2020 · updated 17/06/2026

Package	Affected versions	Patched versions
smart asset damstratechnology	`= 2020.7`	No fix yet

Description

Damstra Smart Asset 2020.7 has SQL injection via the API/api/Asset originator parameter. This allows forcing the database and server to initiate remote connections to third party DNS servers.

References

lukaszstu/SmartAsset-SQLinj-CVE-2020-26525 · Third Party Advisory
support.damstratechnology.com/hc/en-us/categories/900000115446-SmartAsset-Damstra-Asset-Management-Platform · Vendor Advisory
smartasset.com.au · Product

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free