CVE-2020-28860 – CVE-2020-28860 is an authenticated blind SQL in... (How to Fix)

Q: What is the severity of CVE-2020-28860?

CVE-2020-28860 has a CVSS score of 8.8 (HIGH). CVE-2020-28860 is an authenticated blind SQL injection vulnerability in OpenAsset Digital Asset Management (DAM) software. Attackers with valid credentials can inject malicious SQL queries to extract, modify, or delete database content. Organizations using OpenAsset DAM through version 12.0.19 are affected.

📋 TL;DR

CVE-2020-28860 is an authenticated blind SQL injection vulnerability in OpenAsset Digital Asset Management (DAM) software. Attackers with valid credentials can inject malicious SQL queries to extract, modify, or delete database content. Organizations using OpenAsset DAM through version 12.0.19 are affected.

💻 Affected Systems

Products:

OpenAsset Digital Asset Management

Versions: through 12.0.19

Operating Systems: Windows, Linux

Default Config Vulnerable: ⚠️ Yes

Notes: Requires authenticated user access; all deployments using vulnerable versions are affected.

📦 What is this software?

Digital Asset Management by Openasset

View all CVEs affecting Digital Asset Management →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete database compromise leading to data theft, data destruction, or full system takeover via SQL injection to RCE chaining.

🟠

Likely Case

Unauthorized data access, extraction of sensitive information, and potential privilege escalation within the application.

🟢

If Mitigated

Limited impact with proper input validation, parameterized queries, and network segmentation preventing database access.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploit details and proof-of-concept code are publicly available; requires valid user credentials.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 12.0.20 or later

Vendor Advisory: http://openasset.com

Restart Required: Yes

Instructions:

1. Backup database and application. 2. Download and install OpenAsset DAM version 12.0.20 or later from vendor. 3. Restart application services. 4. Verify patch application.

🔧 Temporary Workarounds

Input Validation Filter

all

Implement web application firewall or input validation to block SQL injection patterns

Database Permission Reduction

all

Restrict database user permissions to minimum required for application functionality

🧯 If You Can't Patch

Implement network segmentation to isolate OpenAsset DAM from critical databases
Enable detailed SQL query logging and monitoring for injection attempts

🔍 How to Verify

Check if Vulnerable:

Check OpenAsset DAM version in admin interface; versions 12.0.19 and earlier are vulnerable.

Check Version:

Check admin dashboard or application configuration files for version information

Verify Fix Applied:

Verify version is 12.0.20 or later and test SQL injection attempts are blocked.

📡 Detection & Monitoring

Log Indicators:

Unusual SQL query patterns
Multiple failed login attempts followed by complex queries
Database error messages containing SQL syntax

Network Indicators:

Unusual database connection patterns from application server
SQL injection payloads in HTTP requests

SIEM Query:

source="openasset.logs" AND ("sql" OR "injection" OR "union select" OR "sleep(")

📊 Metadata

CVE ID: CVE-2020-28860

CVSS v3 Score: 8.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-89

Published: December 14, 2020

Last Updated: November 21, 2024

🔗 References

http://openasset.com Vendor Advisory
http://packetstormsecurity.com/files/160459/OpenAsset-Digital-Asset-Management-SQL-Injection.html Exploit,Third Party Advisory,VDB Entry
http://seclists.org/fulldisclosure/2020/Dec/21 Exploit,Mailing List,Third Party Advisory
https://www.themissinglink.com.au/security-advisories-cve-2020-28860 Third Party Advisory
http://openasset.com Vendor Advisory
http://packetstormsecurity.com/files/160459/OpenAsset-Digital-Asset-Management-SQL-Injection.html Exploit,Third Party Advisory,VDB Entry
http://seclists.org/fulldisclosure/2020/Dec/21 Exploit,Mailing List,Third Party Advisory
https://www.themissinglink.com.au/security-advisories-cve-2020-28860 Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2020-28860, you might also want to check these: