TestLink 1.9.13 SQL Injection

`Information  
--------------------  
Advisory by Netsparker.  
Name: SQL Injection Vulnerability in TestLink 1.9.13  
Affected Software : TestLink  
Affected Versions: 1.9.1.3 and possibly below  
Vendor Homepage : http://testlink.org/  
Vulnerability Type : SQL Injection  
Severity : Critical  
Status : Fixed  
CVE-ID : CVE-2015-7390  
Netsparker Advisory Reference : NS-15-015  
  
Description  
--------------------  
If your web application is vulnerable to SQL injection, a hacker is  
able to execute any malicious SQL query or command through the web  
application.  
  
Technical Details  
--------------------  
Proof of Concept URLs for SQL Injection vulnerability in TestLink:  
  
Page: lnl.php  
Parameter Name: apikey  
Parameter Type: GET  
Attack Pattern: '+(SELECT 1 FROM (SELECT SLEEP(25))A)+'  
  
For more information on SQL Injection vulnerabilities read the  
following article:  
https://www.netsparker.com/web-vulnerability-scanner/vulnerability-security-checks-index/sql-injection/  
  
Advisory Timeline  
--------------------  
15/09/2015 - First Contact  
02/10/2015 - Vendor Fixed  
05/10/2015 - Advisory Released  
  
Solution  
--------------------  
https://github.com/TestLinkOpenSourceTRMS/testlink-code/releases/tag/1.9.14  
  
Credits & Authors  
--------------------  
These issues have been discovered by Omar Kurt while testing  
Netsparker Web Application Security Scanner  
(https://www.netsparker.com).  
  
About Netsparker  
--------------------  
Netsparker web application security scanners find and report security  
flaws and vulnerabilities such as SQL Injection and Cross-site  
Scripting (XSS) in all websites and web applications, regardless of  
the platform and technology they are built on. Netsparker scanning  
engine’s unique detection and exploitation techniques allow it to be  
dead accurate in reporting vulnerabilities, hence it does not report  
any false positives. The Netsparker web application security scanner  
is available in two editions; Netsparker Desktop and Netsparker Cloud.  
Visit our website https://www.netsparker.com for more information.  
  
--   
Onur Yılmaz - National General Manager  
  
Netsparker Web Application Security Scanner  
T: +90 (0)554 873 0482  
`