CVE-2019-20107 Multiple SQL injection vulnerabilities in TestLink through 1.9.19 allows remote authenticated users to execute arbitrary SQL commands via the (1) tproject_id parameter to keywordsView.php; the (2) req...
HighCVSS 8.8
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple SQL injection vulnerabilities in TestLink through 1.9.19 allows remote authenticated users to execute arbitrary SQL commands via the (1) tproject_id parameter to keywordsView.php; the (2) req_spec_id parameter to reqSpecCompareRevisions.php; the (3) requirement_id parameter to reqCompareVersions.php; the (4) build_id parameter to planUpdateTC.php; the (5) tplan_id parameter to newest_tcversions.php; the (6) tplan_id parameter to tcCreatedPerUserGUI.php; the (7) tcase_id parameter to tcAssign2Tplan.php; or the (8) testcase_id parameter to tcCompareVersions.php. Authentication is often easy to achieve: a guest account, that can execute this attack, can be created by anyone in the default configuration.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| testlink | <= 1.9.19 | No fix listed |
References
- mantis.testlink.org vendor-advisory
- github.com patch third-party-advisory
- github.com patch third-party-advisory
- github.com patch third-party-advisory
- github.com patch third-party-advisory
- github.com patch third-party-advisory
- github.com patch third-party-advisory
- twitter.com third-party-advisory