CVE-2020-15849

CVE-2020-15849 is a blind authenticated SQL injection vulnerability in Re:Desk 2.3, specifically within the SettingsController's actionEmailTemplates() method. An attacker with administrative credentials can exploit this to extract sensitive database information, bypass authorization, and potentially take over other accounts by manipulating password reset tokens. The vulnerability also allows for remote code execution through the Yii framework's bizRule functionality or in conjunction with an insecure file upload vulnerability (CVE-2020-15488). This vulnerability is rated High severity (CVSS 7.2), indicating a network-based attack with low complexity, requiring high privileges, and leading to high impacts on confidentiality, integrity, and availability. The EPSS score suggests a low probability of exploitation in the wild. Currently, there is no evidence of active exploitation, and no public exploit code is available on platforms like Metasploit or ExploitDB. Community discussion and media coverage for this CVE are minimal, aligning with the typical lack of attention for most vulnerabilities.