Fat Free CRM vulnerable to SQL Injection

2022-05-1704:55:27

Google

osv.dev

0.003 Low

EPSS

Percentile

70.9%

JSON

Multiple SQL injection vulnerabilities in app/controllers/home_controller.rb in Fat Free CRM before 0.12.1 allow remote authenticated users to execute arbitrary SQL commands via (1) the homepage timeline feature or (2) the activity feature.

CPENameOperatorVersion
fat_free_crmeq0.11.3
fat_free_crmeq0.11.2
fat_free_crmeq0.11.1
fat_free_crmeq0.12.0
fat_free_crmeq0.11.0
fat_free_crmeq0.11.4

Name	Operator	Version
fat_free_crm	eq	0.11.3
fat_free_crm	eq	0.11.2
fat_free_crm	eq	0.11.1
fat_free_crm	eq	0.12.0
fat_free_crm	eq	0.11.0
fat_free_crm	eq	0.11.4

References

openwall.com/lists/oss-security/2013/12/28/2

seclists.org/fulldisclosure/2013/Dec/199

github.com/fatfreecrm/fat_free_crm

github.com/fatfreecrm/fat_free_crm/commit/078035f1ef73ed85285ac9d128c3c5f670cef066

github.com/fatfreecrm/fat_free_crm/commit/d4b2de81a4d8c1b201482edcb2488ed9280a65fd

github.com/fatfreecrm/fat_free_crm/issues/300

github.com/fatfreecrm/fat_free_crm/wiki/Fixing-security-vulnerabilities-%2827th-Dec-2013%29

nvd.nist.gov/vuln/detail/CVE-2013-7225

0.003 Low

EPSS

Percentile

70.9%

JSON

Related for OSV:GHSA-9GGP-5RF4-X7Q9