9

CVE-2014-5308

Exploit
Multiple SQL injection vulnerabilities in TestLink 1.9.11 allow remote authenticated users to execute arbitrary SQL commands via the (1) name parameter in a Search action to lib/project/projectView.php or (2) id parameter to lib/events/eventinfo.php.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Testlink ≫ Testlink Version1.9.11
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.53% 0.877
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9 8 10
AV:N/AC:L/Au:S/C:C/I:C/A:C
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

http://osvdb.org/show/osvdb/112524
http://packetstormsecurity.com/files/128521/TestLink-1.9.11-SQL-Injection.html
Exploit
http://seclists.org/fulldisclosure/2014/Oct/11
Exploit
http://seclists.org/fulldisclosure/2014/Oct/13
Exploit
http://www.exploit-db.com/exploits/34863
Exploit
http://www.securityfocus.com/bid/70207
https://gitorious.org/testlink-ga/testlink-code/commit/7a099737b4c739bf083df016c0a99f66dd8ac0b3
Exploit
https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-5308
Exploit