CVE-2014-5308

🗓️ 08 Oct 2014 17:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 51 Views🌐 WEB

Multiple SQL injection vulnerabilities in TestLink 1.9.11 allow remote authenticated users to execute arbitrary SQL commands via the (1) name parameter in a Search action to lib/project/projectView.php or (2) id parameter to lib/events/eventinfo.php

Reporter	Title	Published	Views	Family All 9
0day.today	TestLink 1.9.11 - Multiple SQL Injection Vulnerabilities	2 Oct 201400:00	–	zdt
Circl	CVE-2014-5308	2 Oct 201400:00	–	circl
Cvelist	CVE-2014-5308	8 Oct 201417:00	–	cvelist
Exploit DB	TestLink 1.9.11 - Multiple SQL Injections	2 Oct 201400:00	–	exploitdb
exploitpack	TestLink 1.9.11 - Multiple SQL Injections	2 Oct 201400:00	–	exploitpack
NVD	CVE-2014-5308	8 Oct 201417:55	–	nvd
Packet Storm	TestLink 1.9.11 SQL Injection	1 Oct 201400:00	–	packetstorm
Prion	Sql injection	8 Oct 201417:55	–	prion
seebug.org	TestLink 1.9.11 - Multiple SQL Injection Vulnerabilities	10 Oct 201400:00	–	seebug

NVD

Node

testlink testlinkMatch1.9.11

Source	Link
seclists	www.seclists.org/fulldisclosure/2014/Oct/11
packetstormsecurity	www.packetstormsecurity.com/files/128521/TestLink-1.9.11-SQL-Injection.html
osvdb	www.osvdb.org/show/osvdb/112524
portcullis-security	www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-5308
gitorious	www.gitorious.org/testlink-ga/testlink-code/commit/7a099737b4c739bf083df016c0a99f66dd8ac0b3
securityfocus	www.securityfocus.com/bid/70207
seclists	www.seclists.org/fulldisclosure/2014/Oct/13
exploit-db	www.exploit-db.com/exploits/34863

Parameter	Position	Path	Description	CWE
name	request body	testlink/lib/project/projectView.php?doAction=search	SQL injection via name parameter in project search action	CWE-89
id	request body	testlink/lib/events/eventinfo.php	SQL injection via id parameter in event info retrieval	CWE-89

06 May 2026 22:30Current

8.2High risk

Vulners AI Score8.2

CVSS 29

EPSS0.13551

CWE-89