CVE-2020-26712: REDCap 10.3.4 contains a SQL injection vulnerability in the ToDoList function via sort parameter. The application uses the addition of a string of information from the submitted user that is not va...

Summary

REDCap 10.3.4 contains a SQL injection vulnerability in the ToDoList function via sort parameter. The application uses the addition of a string of information from the submitted user that is not validated well in the database query, resulting in an SQL injection vulnerability where an attacker can e...

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
vanderbilt	redcap	10.0.20 10.3.4 `cpe:2.3:a:vanderbilt:redcap:10.0.20::::lts:::`

Original advisory text

REDCap 10.3.4 contains a SQL injection vulnerability in the ToDoList function via sort parameter. The application uses the addition of a string of information from the submitted user that is not va...

REDCap 10.3.4 contains a SQL injection vulnerability in the ToDoList function via sort parameter. The application uses the addition of a string of information from the submitted user that is not validated well in the database query, resulting in an SQL injection vulnerability where an attacker can exploit and compromise all databases.

References

https://github.com/vuongdq54/RedCap Exploit Third Party Advisory
https://www.evms.edu/research/resources_services/redcap/redcap_change_log/ Release Notes Vendor Advisory
https://www.project-redcap.org/ Product Vendor Advisory