CVE-2014-5308 Multiple SQL injection vulnerabilities in TestLink 1.9.11 allow remote authenticated users to execute arbitrary SQL commands via the (1) name parameter in a Search action to lib/project/projectView.ph...
HighCVSS 9.0
EPSS 3.5%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple SQL injection vulnerabilities in TestLink 1.9.11 allow remote authenticated users to execute arbitrary SQL commands via the (1) name parameter in a Search action to lib/project/projectView.php or (2) id parameter to lib/events/eventinfo.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| testlink | = 1.9.11 | No fix listed |
References
- 112524 vdb-entry
- packetstormsecurity.com exploit
- 20141001 CVE-2014-5308 - Multiple SQL Injection Vulnerabilities in TestLink exploit mailing-list
- 20141001 Re: CVE-2014-5308 - Multiple SQL Injection Vulnerabilities in TestLink exploit mailing-list
- 34863 exploit
- 70207 vdb-entry
- gitorious.org exploit
- www.portcullis-security.com exploit