CVE-2013-3525 | BDVDB-2026-55779 Detail
Description#
SQL injection vulnerability in Approvals/ in Request Tracker (RT) 4.0.10 and earlier allows remote attackers to execute arbitrary SQL commands via the ShowPending parameter. NOTE: the vendor disputes this issue, stating "We were unable to replicate it, and the individual that reported it retracted their report," and "we had verified that the claimed exploit did not function according to the author's claims.
Impact#
No impact statement in the source data.
Weaknesses#
No weakness recorded in the source data.
References#
- http://cxsecurity.com/issue/WLB-2013040083
- http://osvdb.org/92265
- http://blog.bestpractical.com/2013/04/on-our-security-policies.html
- http://www.securityfocus.com/bid/59022
- http://packetstormsecurity.com/files/121245/RT-Request-Tracker-4.0.10-SQL-Injection.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/83375
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.