TI-2020-07199 Aliases CVE-2020-8967 GHSA-jx4q-cg94-9r74

GESIO SQL injection vulnerability

MEDIUM 45CWE-89Published 2020-06-01 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: SQL injection
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

There is an improper Neutralization of Special Elements used in an SQL Command (SQL Injection) vulnerability in php files of GESIO ERP. GESIO ERP all versions prior to 11.2 allows malicious users to retrieve all database information.

Why it matters now

EPSS 0.01034 64th percentileScored 2026-11-07

Fix Fixed GESIO ERP (Gesio (GESTIÓN INTEGRAL ONLINE, SL)): 11.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Gesio (GESTIÓN INTEGRAL ONLINE, SL)	GESIO ERP	11.2 to before 11.2	11.2	Patch available	CNA

GESIO ERP VendorGesio (GESTIÓN INTEGRAL ONLINE, SL) Affected 11.2 to before 11.2 Fixed in 11.2 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:gesio:erp::::::::	before 11.2	Vulnerable	Gesio

cpe:2.3:a:gesio:erp:*:*:*:*:*:*:*:* Versions before 11.2 Vulnerable ·Gesio

Remediation

Fix · CNA GESIO ERP (Gesio (GESTIÓN INTEGRAL ONLINE, SL)) Fixed in 11.2

Timeline

2026-10-02 Threatist record created from CVE-2020-8967
2026-10-03 Alias added: GHSA-jx4q-cg94-9r74

References

Advisory 1

https://www.incibe-cert.es/en/early-warning/security-advisories/gesio-sql-injection-vulnerability

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences