PT-2020-10305

Name of the Vulnerable Software and Affected Versions Selesta Visual Access Manager VAM versions 4.15.0 through 4.29 Description An issue allows an attacker without authentication to execute arbitrary SQL SELECT statements by injecting the HTTP parameter persoid into the "/tools/VamPersonPhoto.ph...