critical9.8
CVE-2020-9406
IBL Online Weather before 4.3.5a allows unauthenticated eval injection via the queryBCP method of the Auxiliary Service.
Impact
IBL Online Weather before 4.3.5a allows unauthenticated eval injection via the queryBCP method of the Auxiliary Service.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Iblsoft | Online Weather | before 4.3.5 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/dawid-czarnecki/public-vulnerabilities/tree/master/Online_Weather
- https://zigrin.com/advisories/online-weather-command-injection-in-querybcp-method/
- https://github.com/dawid-czarnecki/public-vulnerabilities/tree/master/Online_Weather
- https://zigrin.com/advisories/online-weather-command-injection-in-querybcp-method/