CVE-2018-8820 – Square 9 GlobalForms 6.2.x Blind SQL Injection

https://notcve.org/view.php?id=CVE-2018-8820

28 Mar 2018 — An issue was discovered in Square 9 GlobalForms 6.2.x. A Time Based SQL injection vulnerability in the "match" parameter allows remote authenticated attackers to execute arbitrary SQL commands. It is possible to upgrade access to full server compromise via xp_cmdshell. In some cases, the authentication requirement for the attack can be met by sending the default admin credentials. Se ha descubierto un problema en Square 9 GlobalForms 6.2.x. • https://packetstorm.news/files/id/146942 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •