Mailtrain through 1.24.1 allows SQL Injection in statsClickedSubscribersByColumn in lib/models/campaigns.js via /campaigns/clicked/ajax because variable column names are not properly escaped.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2021-02-19T22:48:01

Updated: 2024-08-04T15:19:08.953Z

Reserved: 2020-08-25T00:00:00

Link: CVE-2020-24617

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2021-02-19T23:15:12.577

Modified: 2024-11-21T05:15:10.847

Link: CVE-2020-24617

cve-icon Redhat

No data.