PT-2014-4894

Name of the Vulnerable Software and Affected Versions KnowledgeTree versions 3.7.0.2 and earlier Description The issue allows remote attackers to execute arbitrary SQL commands. This is related to the getFileName function in the KTAPI UserSession class. The get active session function in...

CVE-2014-2737: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the getactivesession function in the KTAPIUserSession class in webservice/clienttools/services/mdownload.php in KnowledgeTree 3.7.0.2 and earlier allows remote attackers to execute arbitrary SQL commands via the u parameter, related to the getFileName function...