CVE-2009-4238

Опубликовано: 10 дек. 2009

Источник: nvd

CVSS2: 6.5

EPSS Низкий

Описание

Multiple SQL injection vulnerabilities in TestLink before 1.8.5 allow remote authenticated users to execute arbitrary SQL commands via (1) the Test Case ID field to lib/general/navBar.php or (2) the logLevel parameter to lib/events/eventviewer.php.

Ссылки

http://archives.neohapsis.com/archives/fulldisclosure/2009-12/0221.html
http://osvdb.org/60919
http://osvdb.org/60920
http://www.coresecurity.com/content/testlink-multiple-injection-vulnerabilities
Exploit
http://www.securityfocus.com/bid/37258
Exploit
http://www.teamst.org/index.php?option=com_content&task=view&id=84&Itemid=2
Patch
Vendor Advisory
URL Repurposed
http://archives.neohapsis.com/archives/fulldisclosure/2009-12/0221.html
http://osvdb.org/60919
http://osvdb.org/60920
http://www.coresecurity.com/content/testlink-multiple-injection-vulnerabilities
Exploit
http://www.securityfocus.com/bid/37258
Exploit
http://www.teamst.org/index.php?option=com_content&task=view&id=84&Itemid=2
Patch
Vendor Advisory
URL Repurposed

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:teamst:testlink:1.7:*:*:*:*:*:*:*

cpe:2.3:a:teamst:testlink:1.7.1:*:*:*:*:*:*:*

cpe:2.3:a:teamst:testlink:1.7.2:*:*:*:*:*:*:*

cpe:2.3:a:teamst:testlink:1.7.3:*:*:*:*:*:*:*

cpe:2.3:a:teamst:testlink:1.7.4:*:*:*:*:*:*:*

cpe:2.3:a:teamst:testlink:1.8:*:*:*:*:*:*:*

cpe:2.3:a:teamst:testlink:1.8:beta1:*:*:*:*:*:*

cpe:2.3:a:teamst:testlink:1.8:beta2:*:*:*:*:*:*

cpe:2.3:a:teamst:testlink:1.8:beta3:*:*:*:*:*:*

cpe:2.3:a:teamst:testlink:1.8:rc1:*:*:*:*:*:*

cpe:2.3:a:teamst:testlink:1.8.0:*:*:*:*:*:*:*

cpe:2.3:a:teamst:testlink:1.8.1:*:*:*:*:*:*:*

cpe:2.3:a:teamst:testlink:1.8.2:*:*:*:*:*:*:*

cpe:2.3:a:teamst:testlink:1.8.3:*:*:*:*:*:*:*

cpe:2.3:a:teamst:testlink:1.8.4:*:*:*:*:*:*:*

EPSS

Процентиль: 76%

0.00967

Низкий

6.5 Medium

CVSS2

Дефекты

CWE-89

Связанные уязвимости

GHSA-7cwx-8f2v-v265

github

почти 4 года назад