Sql injection

SQL injection vulnerability in XRMS CRM, possibly 1.99.2, allows remote attackers to execute arbitrary SQL commands via the userid parameter to plugins/webform/new-form.php, which is not properly handled by plugins/useradmin/fingeruser.php...

PT-2014-6506

Name of the Vulnerable Software and Affected Versions XRMS CRM version 1.99.2 Description The issue allows remote attackers to execute arbitrary SQL commands via the user id parameter to "plugins/webform/new-form.php", which is not properly handled by "plugins/useradmin/fingeruser.php"...

CVE-2014-5520: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in XRMS CRM, possibly 1.99.2, allows remote attackers to execute arbitrary SQL commands via the userid parameter to plugins/webform/new-form.php, which is not properly handled by plugins/useradmin/fingeruser.php...

CVE-2014-5521

XRMS CRM (plugin path plugins/useradmin/fingeruser.php) is affected by CVE-2014-5521. The vulnerability allows remote authenticated users to execute arbitrary code through shell metacharacters in the username parameter, due to insufficient input validation in fingeruser.php (likely in XRMS CRM 1....

PT-2014-6507

Name of the Vulnerable Software and Affected Versions XRMS CRM version 1.99.2 Description The issue allows remote authenticated users to execute arbitrary code via shell metacharacters in the username parameter in the plugins/useradmin/fingeruser.php file. Recommendations For version 1.99.2, avoi...

CVE-2014-5521: Improper Neutralization of Special Elements used in an SQL Command

plugins/useradmin/fingeruser.php in XRMS CRM, possibly 1.99.2, allows remote authenticated users to execute arbitrary code via shell metacharacters in the username parameter...