CVE-2014-5308

Multiple SQL injection vulnerabilities in TestLink 1.9.11 allow remote authenticated users to execute arbitrary SQL commands via the 1 name parameter in a Search action to lib/project/projectView.php or 2 id parameter to lib/events/eventinfo.php...

CVE-2014-5308

Summary (CVE-2014-5308) : In TestLink 1.9.11, there are multiple SQL injection vulnerabilities exploitable by an authenticated remote attacker . The confirmed vectors affect: (1) the name parameter of the Search action to lib/project/projectView.php, and (2) the id parameter to lib/events/eventin...

CVE-2014-5308: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in TestLink 1.9.11 allow remote authenticated users to execute arbitrary SQL commands via the 1 name parameter in a Search action to lib/project/projectView.php or 2 id parameter to lib/events/eventinfo.php...

PT-2014-6396

Name of the Vulnerable Software and Affected Versions TestLink version 1.9.11 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This can be achieved via the name parameter in a Search action to "lib/project/projectView.php" or the id parameter to...

TestLink 1.9.11 - Multiple SQL Injections

TestLink 1.9.11 - Multiple SQL Injections Vulnerability title: Multiple SQL Injection Vulnerabilities in TestLink CVE: CVE-2014-5308 Vendor: Testlink Product: TestLink Affected version: 1.9.11 Fixed version: Fixed in SVN commit number 7a09973 Reported by: Jerzy Kramarz Details: Two SQL injection...

TestLink 1.9.11 - Multiple SQL Injection Vulnerabilities

Two SQL injection vulnerabilities have been found and confirmed within the software as an authenticated user. A successful attack could allow an authenticated attacker to access information such as usernames and password hashes that are stored in the database. The following URLs and parameters ha...

TestLink 1.9.11 - Multiple SQL Injections

Vulnerability title: Multiple SQL Injection Vulnerabilities in TestLink CVE: CVE-2014-5308 Vendor: Testlink Product: TestLink Affected version: 1.9.11 Fixed version: Fixed in SVN commit number 7a09973 Reported by: Jerzy Kramarz Details: Two SQL injection vulnerabilities have been found and...

TestLink 1.9.11 SQL Injection

Vulnerability title: Multiple SQL Injection Vulnerabilities in TestLink CVE: CVE-2014-5308 Vendor: Testlink Product: TestLink Affected version: 1.9.11 Fixed version: Fixed in SVN commit number 7a09973 Reported by: Jerzy Kramarz Details: Two SQL injection vulnerabilities have been found and...

CVE-2012-0939

Multiple SQL injection vulnerabilities in TestLink 1.8.5b and earlier allow remote authenticated users with the Requirement view permission to execute arbitrary SQL commands via the reqspecid parameter to 1 reqSpecAnalyse.php, 2 reqSpecPrint.php, or 3 reqSpecView.php in requirements/. NOTE: some ...

CVE-2012-0938

Multiple SQL injection vulnerabilities in TestLink 1.9.3, 1.8.5b, and earlier allow remote authenticated users with certain permissions to execute arbitrary SQL commands via the rootnode parameter in the displaychildren function to 1 getrequirementnodes.php or 2 gettprojectnodes.php in lib/ajax/;...

Sql injection

Multiple SQL injection vulnerabilities in TestLink 1.9.3, 1.8.5b, and earlier allow remote authenticated users with certain permissions to execute arbitrary SQL commands via the rootnode parameter in the displaychildren function to 1 getrequirementnodes.php or 2 gettprojectnodes.php in lib/ajax/;...

Sql injection

Multiple SQL injection vulnerabilities in TestLink 1.8.5b and earlier allow remote authenticated users with the Requirement view permission to execute arbitrary SQL commands via the reqspecid parameter to 1 reqSpecAnalyse.php, 2 reqSpecPrint.php, or 3 reqSpecView.php in requirements/. NOTE: some ...

CVE-2012-0938

Multiple SQL injection vulnerabilities in TestLink 1.9.3, 1.8.5b, and earlier allow remote authenticated users with certain permissions to execute arbitrary SQL commands via the rootnode parameter in the displaychildren function to 1 getrequirementnodes.php or 2 gettprojectnodes.php in lib/ajax/;...

CVE-2012-0939

Multiple SQL injection vulnerabilities in TestLink 1.8.5b and earlier allow remote authenticated users with the Requirement view permission to execute arbitrary SQL commands via the reqspecid parameter to 1 reqSpecAnalyse.php, 2 reqSpecPrint.php, or 3 reqSpecView.php in requirements/. NOTE: some ...

CVE-2012-0939

CVE-2012-0939 affects TestLink up to v1.8.5b; the vulnerability is an SQL injection in the requirements module. Specifically, unauthenticated? No: remote authenticated users with the Requirement view permission can exploit the flaw via req_spec_id in reqSpecAnalyse.php, reqSpecPrint.php, or reqSp...

CVE-2012-0938

Summary of CVE-2012-0938 (TestLink SQL Injection) : Affected software is TestLink v1.8.5b and v1.9.3 (and possibly earlier) with multiple SQL injection flaws that permit remote authenticated users with certain permissions to execute arbitrary SQL via various parameters in lib/ajax, lib/cfields, l...

CVE-2012-0938

Multiple SQL injection vulnerabilities in TestLink 1.9.3, 1.8.5b, and earlier allow remote authenticated users with certain permissions to execute arbitrary SQL commands via the rootnode parameter in the displaychildren function to 1 getrequirementnodes.php or 2 gettprojectnodes.php in lib/ajax/;...

CVE-2012-0938: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in TestLink 1.9.3, 1.8.5b, and earlier allow remote authenticated users with certain permissions to execute arbitrary SQL commands via the rootnode parameter in the displaychildren function to 1 getrequirementnodes.php or 2 gettprojectnodes.php in lib/ajax/;...

PT-2014-2211

Name of the Vulnerable Software and Affected Versions TestLink versions 1.9.3, 1.8.5b, and earlier Description The issue allows remote authenticated users with certain permissions to execute arbitrary SQL commands. This can be achieved via several parameters in different files, including the root...

CVE-2012-0939: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in TestLink 1.8.5b and earlier allow remote authenticated users with the Requirement view permission to execute arbitrary SQL commands via the reqspecid parameter to 1 reqSpecAnalyse.php, 2 reqSpecPrint.php, or 3 reqSpecView.php in requirements/. NOTE: some ...