Selesta Visual Access Manager SQL Injection Vulnerability

Selesta Visual Access Manager VAM is the Selesta Visual Access Manager. A SQL injection vulnerability exists in Selesta Visual Access Manager VAM versions 4.15.0 through 4.29. An attacker can exploit the vulnerability by injecting the 'persoid' parameter into the /tools/VamPersonPhoto.php file to...

CVE-2019-19986

An issue was discovered in Selesta Visual Access Manager VAM 4.15.0 through 4.29. An attacker without authentication is able to execute arbitrary SQL SELECT statements by injecting the HTTP POST or GET parameter persoid into /tools/VamPersonPhoto.php. The SQL Injection type is Error-based this...