CVE-2020-12606

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-08-17 · updated 2026-06-17
Weakness: CWE-89

Description

An issue was discovered in DB Soft SGLAC before 20.05.001. The ProcedimientoGenerico method in the SVCManejador.svc webservice of the SGLAC web frontend allows an attacker to run arbitrary SQL commands on the SQL Server. Command execution can be easily achieved by using the xp_cmdshell stored procedure.

Affected products

Dbsoft Sglac: before 20.05.001 — fixed in 20.05.001

How to fix

Upgrade to a fixed version: Dbsoft Sglac 20.05.001. Check the vendor advisory for mitigations.

References

https://github.com/blackarrowsec/advisories/tree/master/2020/CVE-2020-12606
https://github.com/blackarrowsec/advisories/tree/master/2020/CVE-2020-12606

Get alerted when CVE-2020-12606 or the next vulnerability affects your stack