CVE-2011-5071

Опубликовано: 29 янв. 2012

Источник: nvd

CVSS2: 7.5

EPSS Низкий

Описание

Multiple SQL injection vulnerabilities in Support Incident Tracker (aka SiT!) before 3.64 allow remote attackers to execute arbitrary SQL commands via the (1) exc[] parameter to report_marketing.php, (2) selected[] parameter to tasks.php, (3) sites[] parameter to billable_incidents.php, or (4) search_string parameter to search.php. NOTE: some of these details are obtained from third party information.

Ссылки

http://en.securitylab.ru/lab/PT-2011-25
http://seclists.org/bugtraq/2011/Jul/174
http://secunia.com/advisories/45277
Vendor Advisory
http://secunia.com/advisories/45437
Vendor Advisory
http://sitracker.org/wiki/ReleaseNotes364
http://en.securitylab.ru/lab/PT-2011-25
http://seclists.org/bugtraq/2011/Jul/174
http://secunia.com/advisories/45277
Vendor Advisory
http://secunia.com/advisories/45437
Vendor Advisory
http://sitracker.org/wiki/ReleaseNotes364

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:sitracker:support_incident_tracker:*:*:*:*:*:*:*:*

Версия до 3.63 (включая)

cpe:2.3:a:sitracker:support_incident_tracker:3.6:*:*:*:*:*:*:*

cpe:2.3:a:sitracker:support_incident_tracker:3.21:*:*:*:*:*:*:*

cpe:2.3:a:sitracker:support_incident_tracker:3.22:*:*:*:*:*:*:*

cpe:2.3:a:sitracker:support_incident_tracker:3.22pl1:*:*:*:*:*:*:*

cpe:2.3:a:sitracker:support_incident_tracker:3.23:*:*:*:*:*:*:*

cpe:2.3:a:sitracker:support_incident_tracker:3.24:*:*:*:*:*:*:*

cpe:2.3:a:sitracker:support_incident_tracker:3.24:beta-2:*:*:*:*:*:*

cpe:2.3:a:sitracker:support_incident_tracker:3.30:*:*:*:*:*:*:*

cpe:2.3:a:sitracker:support_incident_tracker:3.30:beta2:*:*:*:*:*:*

cpe:2.3:a:sitracker:support_incident_tracker:3.31:*:*:*:*:*:*:*

cpe:2.3:a:sitracker:support_incident_tracker:3.32:*:*:*:*:*:*:*

cpe:2.3:a:sitracker:support_incident_tracker:3.33:*:*:*:*:*:*:*

cpe:2.3:a:sitracker:support_incident_tracker:3.35:*:*:*:*:*:*:*

cpe:2.3:a:sitracker:support_incident_tracker:3.35:beta1:*:*:*:*:*:*

cpe:2.3:a:sitracker:support_incident_tracker:3.36:*:*:*:*:*:*:*

cpe:2.3:a:sitracker:support_incident_tracker:3.40:*:*:*:*:*:*:*

cpe:2.3:a:sitracker:support_incident_tracker:3.40:beta1:*:*:*:*:*:*

cpe:2.3:a:sitracker:support_incident_tracker:3.41:*:*:*:*:*:*:*

cpe:2.3:a:sitracker:support_incident_tracker:3.45:*:*:*:*:*:*:*

cpe:2.3:a:sitracker:support_incident_tracker:3.45:beta1:*:*:*:*:*:*

cpe:2.3:a:sitracker:support_incident_tracker:3.50:*:*:*:*:*:*:*

cpe:2.3:a:sitracker:support_incident_tracker:3.50:beta1:*:*:*:*:*:*

cpe:2.3:a:sitracker:support_incident_tracker:3.51:*:*:*:*:*:*:*

cpe:2.3:a:sitracker:support_incident_tracker:3.60:*:*:*:*:*:*:*

cpe:2.3:a:sitracker:support_incident_tracker:3.61:*:*:*:*:*:*:*

cpe:2.3:a:sitracker:support_incident_tracker:3.62:*:*:*:*:*:*:*

cpe:2.3:a:sitracker:support_incident_tracker:3.63:beta1:*:*:*:*:*:*

EPSS

Процентиль: 52%

0.00287

Низкий

7.5 High

CVSS2

Дефекты

CWE-89

Связанные уязвимости

GHSA-vr3c-jg69-m4c2

github

больше 3 лет назад