CVE-2016-20096
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
Linknat VOS3000 and VOS2009 up to version 2.1.2.0 contain an unauthenticated SQL injection vulnerability. Attackers can execute arbitrary SQL commands via the name parameter in a POST request to the login endpoint and retrieve data with DBA privileges.
Risk Assessment
An attacker can extract plaintext credentials and other database content, leading to full compromise of the VOS system.
Recommendation
Upgrade VOS3000/VOS2009 to a version newer than 2.1.2.0 and use parameterized SQL queries in the login endpoint.
Original NVD description (English source)
Linknat VOS3000 and VOS2009 through version 2.1.2.0 contain an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands by manipulating the name parameter in a POST request to the login endpoint. Attackers can inject malicious SQL through the login form and retrieve injected query results from a subsequent session request, enabling extraction of plaintext credentials and other database content with DBA-level privileges.