Sql injection

SQL injection vulnerability in XRMS CRM, possibly 1.99.2, allows remote attackers to execute arbitrary SQL commands via the userid parameter to plugins/webform/new-form.php, which is not properly handled by plugins/useradmin/fingeruser.php...

PT-2014-6506

Name of the Vulnerable Software and Affected Versions XRMS CRM version 1.99.2 Description The issue allows remote attackers to execute arbitrary SQL commands via the user id parameter to "plugins/webform/new-form.php", which is not properly handled by "plugins/useradmin/fingeruser.php"...

CVE-2014-5520: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in XRMS CRM, possibly 1.99.2, allows remote attackers to execute arbitrary SQL commands via the userid parameter to plugins/webform/new-form.php, which is not properly handled by plugins/useradmin/fingeruser.php...

PT-2014-6507

Name of the Vulnerable Software and Affected Versions XRMS CRM version 1.99.2 Description The issue allows remote authenticated users to execute arbitrary code via shell metacharacters in the username parameter in the plugins/useradmin/fingeruser.php file. Recommendations For version 1.99.2, avoi...