Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2020-12606: An issue was discovered in DB Soft SGLAC before 20.05.001. The ProcedimientoGenerico method in the SVCManejador.svc webservice of the SGLAC web frontend allows an attacker to run arbitrary SQL comm...
CVE-2020-12606 · published 6 years ago
Summary
An issue was discovered in DB Soft SGLAC before 20.05.001. The ProcedimientoGenerico method in the SVCManejador.svc webservice of the SGLAC web frontend allows an attacker to run arbitrary SQL commands on the SQL Server. Command execution can be easily achieved by using the xp_cmdshell stored proced...
What to do
- Update dbsoft sglac to version 20.05.001 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| dbsoft | sglac |
< 20.05.001 cpe:2.3:a:dbsoft:sglac:*:*:*:*:*:*:*:* |
Original advisory text
An issue was discovered in DB Soft SGLAC before 20.05.001. The ProcedimientoGenerico method in the SVCManejador.svc webservice of the SGLAC web frontend allows an attacker to run arbitrary SQL comm...
An issue was discovered in DB Soft SGLAC before 20.05.001. The ProcedimientoGenerico method in the SVCManejador.svc webservice of the SGLAC web frontend allows an attacker to run arbitrary SQL commands on the SQL Server. Command execution can be easily achieved by using the xp_cmdshell stored procedure.
References
- https://github.com/blackarrowsec/advisories/tree/master/2020/CVE-2020-12606 Third Party Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-89SQL Injection
Timeline
Published17 Aug 2020
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2020-12606 · NVD
Track software like this
Free during beta