MunkiReport Software Update module is vulnerable to SQL injection

ALTO 8.8CVE-2020-15887 · GHSA-4qgh-m9vp-48xp · Published 23/07/2020 · updated 17/06/2026

In breve

CVE-2020-15887 è una vulnerabilità ALTO (CVSS 8.8) che riguarda munkireport/softwareupdate, softwareupdate (softwareupdate project).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.3%, superiore al 69.8% delle vulnerabilità.
Correzione: aggiornare a 1.6 o successiva.

Package	Affected versions	Patched versions
munkireport/softwareupdate Packagist	`< 1.6`	`1.6`
softwareupdate softwareupdate_project	`< 1.6`	`1.6`

Description

A SQL injection vulnerability in softwareupdate_controller.php in the Software Update module before 1.6 for MunkiReport allows attackers to execute arbitrary SQL commands via the last URL parameter of the /module/softwareupdate/get_tab_data/ endpoint.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2020-15887 · ADVISORY
munkireport/munkireport-php release · WEB
munkireport/munkireport-php release v5.6.3 · WEB
munkireport/munkireport-php · WEB
munkireport/softwareupdate · PACKAGE
munkireport/softwareupdate release · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free