CVE-2015-7564 TeamPass vulnerable to SQL Injection
CriticalCVSS 9.8
EPSS 3.4%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple SQL injection vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in an action_on_quick_icon action to item.query.php or the (2) order or (3) direction parameter in an (a) connections_logs, (b) errors_logs or (c) access_logs action to view.query.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nilsteampassnet/teampass(Packagist) | < 2.1.25 | 2.1.25 |
| nilsteampassnet/teampass(Packagist) | = 2.1.21 | No fix listed |
| teampass | <= 2.1.24 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com product
- 39559 exploit patch third-party-advisory
- github.com