CVE-2014-4858

Multiple SQL injection vulnerabilities in CWPLogin.aspx in Sabre AirCentre Crew products 2010.2.12.20008 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 username or 2 password field...

CVE-2014-4858

CVE-2014-4858; Sabre AirCentre Crew solutions (version 2010.2.12.20008 and earlier) contain SQL injection vulnerabilities in CWPLogin.aspx, exploitable via the username or password fields. Underlying issue: CWE-89 Improper Neutralization of SQL commands. Impact: remote attacker may bypass authent...