CVE-2020-13525

ProcessMaker 3.4.11 is affected by SQL injection in the sort parameter of the reportTables_Ajax and clientSetupAjax endpoints. The vulnerability arises from unsafely constructed ORDER BY queries using the sort parameter, enabling authenticated attackers to inject SQL. TALOS describes multiple SQL...

CVE-2020-13525: Improper Neutralization of Special Elements used in an SQL Command

The sort parameter in the download page /sysworkflow/en/neoclassic/reportTables/reportTablesAjax is vulnerable to SQL injection in ProcessMaker 3.4.11. A specially crafted HTTP request can cause an SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability...

ProcessMaker sort parameter multiple SQL Injection Vulnerabilities

Summary Multiple SQL injection vulnerabilities exist in the handling of sort parameters in ProcessMaker 3.4.11. A specially crafted HTTP request can cause an SQL injection. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. Tested Versions ProcessMaker 3.4.11...

Processmaker SQL注入漏洞

ProcessMaker is a software suite for workflow management that can be used to automate workflows, create documents, assign roles and users to processes, and more. download page /sysworkflow/en/neoclassic/reportTables/ in ProcessMaker 3.4.11 A SQL injection vulnerability exists in the sort paramete...

ProcessMaker SQL注入漏洞

Processmaker is the United States Processmaker company a Php written for business process management BPM and workflow management of the building system. ProcessMaker version 3.4.11 suffers from SQL injection vulnerabilities that stem from the program failing to properly validate user input, which...

ProcessMaker Enterprise Core Code Execution Vulnerability

ProcessMaker Enterprise Core is a business process management BPM and workflow management software from ProcessMaker, Inc. The software can be through a graphical Web interface for drag-and-drop operations , customize the process of Web forms and so on. A code execution vulnerability exists in...

ProcessMaker Detection (HTTP)

HTTP based detection of ProcessMaker. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.141485";...

CVE-2016-9045

A code execution vulnerability exists in ProcessMaker Enterprise Core 3.0.1.7-community. A specially crafted web request can cause unsafe deserialization potentially resulting in PHP code being executed. An attacker can send a crafted web parameter to trigger this vulnerability...

Remote code execution

A code execution vulnerability exists in ProcessMaker Enterprise Core 3.0.1.7-community. A specially crafted web request can cause unsafe deserialization potentially resulting in PHP code being executed. An attacker can send a crafted web parameter to trigger this vulnerability...

CVE-2016-9045

A code execution vulnerability exists in ProcessMaker Enterprise Core 3.0.1.7-community. A specially crafted web request can cause unsafe deserialization potentially resulting in PHP code being executed. An attacker can send a crafted web parameter to trigger this vulnerability...

CVE-2016-9045

A code execution vulnerability exists in ProcessMaker Enterprise Core 3.0.1.7-community. A specially crafted web request can cause unsafe deserialization potentially resulting in PHP code being executed. An attacker can send a crafted web parameter to trigger this vulnerability...

CVE-2016-9045

Summary: CVE-2016-9045 affects ProcessMaker Enterprise Core 3.0.1.7-community. The vulnerability is a remote code execution due to unsafe deserialization; a crafted web request can trigger PHP code execution by exploiting how input is deserialized. The Proof-of-Concept involves a request paramete...

PT-2018-5061 · Processmaker · Processmaker Enterprise Core

Name of the Vulnerable Software and Affected Versions: ProcessMaker Enterprise Core version 3.0.1.7-community Description: A code execution issue exists due to unsafe deserialization. This can be triggered by a specially crafted web request, potentially resulting in PHP code being executed. An...

CVE-2016-9045: Deserialization of Untrusted Data

A code execution vulnerability exists in ProcessMaker Enterprise Core 3.0.1.7-community. A specially crafted web request can cause unsafe deserialization potentially resulting in PHP code being executed. An attacker can send a crafted web parameter to trigger this vulnerability...

CVE-2016-9048

Multiple exploitable SQL Injection vulnerabilities exists in ProcessMaker Enterprise Core 3.0.1.7-community. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially...

Sql injection

Multiple exploitable SQL Injection vulnerabilities exists in ProcessMaker Enterprise Core 3.0.1.7-community. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially...

CVE-2016-9048

Multiple exploitable SQL Injection vulnerabilities exists in ProcessMaker Enterprise Core 3.0.1.7-community. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially...

CVE-2016-9048

Multiple exploitable SQL Injection vulnerabilities exists in ProcessMaker Enterprise Core 3.0.1.7-community. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially...

CVE-2016-9048

TALOS-2017-0313 documents CVE-2016-9048 as multiple SQL injection vulnerabilities in ProcessMaker Enterprise Core 3.0.1.7-community. Exploitation occurs via specially crafted web requests that inject SQL in various endpoints (e.g., eventsAjax, PMTablesSaveFields, ProcessList, translationsAjax). P...

PT-2018-5062 · Processmaker · Processmaker Enterprise Core

Name of the Vulnerable Software and Affected Versions: ProcessMaker Enterprise Core version 3.0.1.7-community Description: The issue allows for SQL Injection attacks through specially crafted web requests. An attacker can exploit this by sending a web request with parameters containing SQL...