CVE-2020-13769: 
Ivanti Endpoint Manager vulnerability analysis and mitigation

LDMS/alert_log.aspx in Ivanti Endpoint Manager through 2020.1 allows SQL Injection via a /remotecontrolauth/api/device request. The vulnerability was discovered in April 2020 and assigned a CVSS score of 7.4 (JUMPSEC Labs).

The vulnerability exists in multiple web components that fail to properly sanitize user input when executing SQL queries. Specifically, the following endpoints and parameters are vulnerable to SQL injection attacks: POST /LDMS/alert_log.aspx with 'filterValue' parameter supporting stacked, time-based blind, and boolean-based blind injection; POST /remotecontrolauth/api/device with 'global', 'displayname', 'ipaddress', and 'owner' parameters supporting time-based blind and boolean-based blind injection. The vulnerability requires authentication to exploit (JUMPSEC Labs).

Since the application uses a database administrator account for database queries by default, successful exploitation could allow an authenticated attacker to execute arbitrary SQL commands with elevated database privileges. This could lead to unauthorized access to and modification of sensitive data in the database (JUMPSEC Labs).

The vulnerability requires authentication and can be exploited remotely. Example exploit payloads include: filterValue=';injection_query_here-- and "global":"'+(injection_query_here)+'" with a valid sessionid (JUMPSEC Labs).

The vulnerability has been patched in Ivanti Endpoint Manager version 2020.1.1. The vendor also reported that version 2019.1.4 includes fixes for this issue. Users are advised to upgrade to these or later versions to resolve the vulnerability (JUMPSEC Labs).