Unrated

Mailtrain through 1.24.1 allows SQL Injection in statsClickedSubscribersByColumn in lib/models/campaigns.js via /campaigns/clicked/ajax because variab...

CVE-2020-24617 First seen on SecPulse Feb 20, 2021

Original description The description as published by the source.

Mailtrain through 1.24.1 allows SQL Injection in statsClickedSubscribersByColumn in lib/models/campaigns.js via /campaigns/clicked/ajax because variable column names are not properly escaped.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

References

patch github.com
report securitylab.github.com

Key facts

Severity: Unrated
Published: Feb 20, 2021
First seen on SecPulse: Feb 20, 2021

NVD OSV

Detection sources

OSV.dev (Open Source Vulnerabilities)Oct 20, 19:52