CVE-2020-11942
📋 TL;DR
CVE-2020-11942 is a critical SQL injection vulnerability in Open-AudIT 3.2.2 that allows attackers to execute arbitrary SQL commands. This affects organizations using Open-AudIT for IT asset management and network discovery. Successful exploitation could lead to complete database compromise.
💻 Affected Systems
- Open-AudIT
📦 What is this software?
Open Audit by Opmantek
⚠️ Risk & Real-World Impact
Worst Case
Full database compromise leading to data theft, privilege escalation, and complete system takeover
Likely Case
Unauthorized data access, modification of audit data, and potential lateral movement within the network
If Mitigated
Limited impact with proper input validation and database permissions
🎯 Exploit Status
SQL injection vulnerabilities are well-understood and often weaponized quickly
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Open-AudIT 3.3.0 and later
Vendor Advisory: https://community.opmantek.com/display/OA/Release+Notes+for+Open-AudIT+v3.3.0
Restart Required: Yes
Instructions:
1. Backup your Open-AudIT database and configuration. 2. Download Open-AudIT 3.3.0 or later from the official repository. 3. Follow the upgrade instructions in the release notes. 4. Restart the web server and verify functionality.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allImplement WAF rules to block SQL injection patterns
Network Segmentation
allRestrict access to Open-AudIT to trusted networks only
🧯 If You Can't Patch
- Implement strict input validation and parameterized queries at application level
- Apply database-level security controls and limit user permissions
🔍 How to Verify
Check if Vulnerable:
Check Open-AudIT version via web interface or configuration filesCheck Version:
Check web interface or config/version.php fileVerify Fix Applied:
Verify version is 3.3.0 or later and test SQL injection vectors📡 Detection & Monitoring
Log Indicators:
- Unusual database queries
- Multiple failed login attempts with SQL syntax
- Unexpected database errors
Network Indicators:
- SQL keywords in HTTP requests to Open-AudIT endpoints
- Unusual database connection patterns
SIEM Query:
source="open-audit" AND ("SELECT" OR "UNION" OR "INSERT" OR "DELETE") AND status=200🔗 References
- https://community.opmantek.com/display/OA/Release+Notes+for+Open-AudIT+v3.3.0
- https://www.coresecurity.com/advisories/open-audit-multiple-vulnerabilities
- https://community.opmantek.com/display/OA/Release+Notes+for+Open-AudIT+v3.3.0
- https://www.coresecurity.com/advisories/open-audit-multiple-vulnerabilities
