CVE-2020-17506: Artica Web Proxy SQL injection in apikey parameter bypasses authentication

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction required, public exploit references, and a very high EPSS score make this an urgent pre-auth compromise path.

What it is

Artica Web Proxy 4.30.00000000 fails to properly sanitize the apikey parameter in fw.login.php, allowing SQL injection that bypasses privilege detection. A remote, unauthenticated attacker can use this to obtain web backend administrator privileges, which is a full compromise of the management interface.

Impact

An attacker gains administrative access to the Artica Web Proxy backend, enabling configuration changes and, per the referenced exploit material, command injection on the host. This effectively hands over control of the proxy and its underlying system.

Attack surface

Reachable over the network via the fw.login.php endpoint with a crafted apikey parameter; the CVSS vector shows no privileges or user interaction required. No authentication is needed to attempt the injection.

Exploitation

Not listed in CISA KEV, but EPSS is 0.93967 (99.84th percentile) and multiple references are tagged Exploit, indicating public exploit code exists and exploitation is likely.

What to do

• Apply the vendor fix for Artica Web Proxy 4.30.00000000 or upgrade to a patched release; verify the current supported version with the vendor since the record does not list fixed versions.
• Restrict network access to the Artica Web Proxy management interface so fw.login.php is not exposed to untrusted networks.
• Use parameterized queries or strict input validation for the apikey parameter in fw.login.php if any custom code is maintained.
• Rotate administrative credentials and API keys for the proxy after patching, in case they were exposed.
• Monitor and alert on anomalous requests to fw.login.php, especially those containing SQL metacharacters in apikey.

Detection

• Inspect web logs for requests to fw.login.php with SQL syntax or unusual characters in the apikey parameter.
• Alert on successful logins to the Artica backend from unexpected source IPs or at unusual times.
• Monitor for post-authentication command execution or configuration changes on the proxy host.
• Correlate proxy management interface access with outbound connections that could indicate command-and-control or lateral movement.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.