CVE-2020-28860

Vulnerability

OpenAsset Digital Asset Management (DAM) versions 12.0.19 (Cloud) and 11.2.1 (On-Premise) are vulnerable to a blind SQL injection in the /AJAXPage/SearchResults endpoint. The application fails to sanitize user-supplied input passed via the currentSearchItems parameter, allowing an authenticated attacker to inject arbitrary SQL queries [2].

Exploitation

An attacker must have valid authentication credentials to the OpenAsset DAM application. By crafting a malicious payload in the currentSearchItems parameter of a request to /AJAXPage/SearchResults, the attacker can perform blind SQL injection. The injection is blind, meaning the attacker must infer database contents through boolean-based or time-based techniques [2].

Impact

Successful exploitation enables the attacker to retrieve all information stored in the application database, including potentially sensitive data such as user credentials, asset metadata, and configuration details. The attack does not require special privileges beyond standard user authentication [2].

Mitigation

The vendor released fixes in version 12.0.23 (Cloud) and 11.4.10 (On-Premise). Users should upgrade to these or later versions. No workarounds are documented in the available references [2].