CVE-2011-5072 | BDVDB-2026-48964 Detail

Description#

Multiple SQL injection vulnerabilities in Support Incident Tracker (aka SiT!) before 3.65 allow remote attackers to execute arbitrary SQL commands via the (1) start parameter to portal/kb.php; (2) contractid parameter to contract_add_service.php; (3) id parameter to edit_escalation_path.php; (4) unlock, (5) lock, or (6) selected parameter to holding_queue.php; inc parameter in a report action to (7) report_customers.php or (8) report_incidents_by_site.php; (9) start parameter to search.php; or (10) sites parameter to transactions.php.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://sitracker.org/wiki/ReleaseNotes365
http://www.securityfocus.com/archive/1/519636
http://secunia.com/advisories/46019
https://www.htbridge.ch/advisory/multiple_vulnerabilities_in_sit_support_incident_tracker.html

Exploit#

No public exploit known

History#

Version 12012-01-29Record published in the CVE List.
Version 22024-09-17Most recent update recorded in the CVE List.