CVE-2015-7299

The CVE-2015-7299 issue affects K2 products: K2 blackpearl, SmartForms, and K2 for SharePoint (version 4.6.7). A Boolean-based SQL injection exists in Runtime/Runtime/AjaxCall.ashx via the xml parameter, allowing an anonymous attacker to read data and potentially access or reconstruct sensitive D...

CVE-2015-7299: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Runtime/Runtime/AjaxCall.ashx in K2 blackpearl, smartforms, and K2 for SharePoint 4.6.7 allows remote attackers to execute arbitrary SQL commands via the xml parameter...

PT-2015-7513

Name of the Vulnerable Software and Affected Versions K2 blackpearl version 4.6.7 K2 smartforms version 4.6.7 K2 for SharePoint version 4.6.7 Description The issue allows remote attackers to execute arbitrary SQL commands via the xml parameter in the Runtime/Runtime/AjaxCall.ashx file. This can b...