CVE-2020-12013 – ICONICS Genesis64 TestQuery SQL Injection Remote Code Execution Vulnerability

https://notcve.org/view.php?id=CVE-2020-12013

30 Jun 2020 — A specially crafted WCF client that interfaces to the may allow the execution of certain arbitrary SQL commands remotely. This affects: Mitsubishi Electric MC Works64 Version 4.02C (10.95.208.31) and earlier, all versions; Mitsubishi Electric MC Works32 Version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server v10.96 and prior; ICONICS GenBroker32 v9.5 and prior. Un cliente WCF especialmente diseñado que interactúa con el puede permitir la ejecución de determinados com... • https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CWE-94: Improper Control of Generation of Code ('Code Injection') •