CVE-2020-12606 Explained : Impact and Mitigation

An issue was discovered in DB Soft SGLAC before 20.05.001, allowing attackers to run arbitrary SQL commands on the SQL Server.

Understanding CVE-2020-12606

What is CVE-2020-12606?

This CVE refers to a vulnerability in the ProcedimientoGenerico method in the SVCManejador.svc webservice of the SGLAC web frontend, enabling attackers to execute SQL commands on the SQL Server.

The Impact of CVE-2020-12606

The vulnerability allows attackers to execute arbitrary SQL commands, potentially leading to unauthorized access, data manipulation, or system compromise.

Technical Details of CVE-2020-12606

Vulnerability Description

The issue in DB Soft SGLAC before version 20.05.001 permits attackers to exploit the ProcedimientoGenerico method to execute SQL commands on the SQL Server, facilitated by the xp_cmdshell stored procedure.

Affected Systems and Versions

Product: DB Soft SGLAC
Version: Before 20.05.001

Exploitation Mechanism

Attackers can exploit the vulnerability by utilizing the ProcedimientoGenerico method in the SVCManejador.svc webservice to execute arbitrary SQL commands on the SQL Server.

Mitigation and Prevention

Immediate Steps to Take

Update DB Soft SGLAC to version 20.05.001 or later to mitigate the vulnerability.
Restrict access to the webservice to authorized users only.

Long-Term Security Practices

Regularly monitor and audit SQL commands executed on the SQL Server.
Implement least privilege access controls to limit the impact of potential SQL injection attacks.

Patching and Updates

Apply security patches and updates provided by DB Soft to address known vulnerabilities in SGLAC.