CVE-2015-20122
Received Received - Intake

Unauthenticated SQL Injection in Seeyon A6 Platform

Publication date: 2026-09-29

Last updated on: 2026-09-29

Assigner: VulnCheck

Description
Seeyon A6 collaborative office automation platform contains an unauthenticated SQL injection vulnerability in the attach_ids parameter of the file attachment download endpoint that allows remote attackers to extract arbitrary database contents without prior authentication. Attackers can inject UNION-based SQL statements through the attach_ids request parameter in downloadAtt.jsp to retrieve sensitive information including credentials and system configuration data. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-17.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-29
Last Modified
2026-09-29
Generated
2026-09-29
AI Q&A
2026-09-29
EPSS Evaluated
N/A
NVD
CVE-2015-20122
EUVD
EUVD-2015-9427

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
seeyon a6 *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an unauthenticated SQL injection vulnerability in the Seeyon A6 collaborative office automation platform. It exists in the attach_ids parameter of the file attachment download endpoint (downloadAtt.jsp). Attackers can inject UNION-based SQL statements through this parameter to extract sensitive database contents without authentication, including credentials and system configurations.

Detection Guidance

To detect this vulnerability, monitor network traffic for suspicious requests to the downloadAtt.jsp endpoint with UNION-based SQL injection payloads in the attach_ids parameter. Check server logs for unusual database queries or errors. Use tools like sqlmap to test for SQL injection by sending crafted attach_ids values such as attach_ids=1 UNION SELECT 1,2,3--.

Impact Analysis

An attacker could exploit this to steal sensitive data such as user credentials, system configurations, or other confidential information stored in the database. Since no authentication is required, any external attacker with network access to the vulnerable system could potentially extract this data.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating compliance requirements under GDPR (data protection) and HIPAA (health information). Organizations using Seeyon A6 may face legal penalties, reputational damage, and mandatory breach notifications if exploited.

Mitigation Strategies

Immediately apply official patches from Seeyon if available. If patches are unavailable, restrict access to the downloadAtt.jsp endpoint via firewall rules or disable it if not needed. Deploy a Web Application Firewall (WAF) to filter malicious attach_ids parameters. Monitor for exploitation attempts and update intrusion detection systems with signatures for this CVE.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2015-20122. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart