CVE-2016-20096

Summary

Linknat VOS3000 and VOS2009 through version 2.1.2.0 contain an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands by manipulating the name parameter in a POST request to the login endpoint. Attackers can inject malicious SQL through the login form and retrieve injected query results from a subsequent session request, enabling extraction of plaintext credentials and other database content with DBA-level privileges.

Affected Software

VendorProductVersion RangeStatus
Kunshi Network Technology Co., Ltd.Linknat VOS30002.1.1.5affected
Kunshi Network Technology Co., Ltd.Linknat VOS30002.1.1.8affected
Kunshi Network Technology Co., Ltd.Linknat VOS30002.1.2.0affected
Kunshi Network Technology Co., Ltd.Linknat VOS20092.1.1.5affected
Kunshi Network Technology Co., Ltd.Linknat VOS20092.1.1.8affected
Kunshi Network Technology Co., Ltd.Linknat VOS20092.1.2.0affected

Weaknesses

  • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

References