CVE-2013-3525

SQL injection vulnerability in Approvals/ in Request Tracker RT 4.0.10 and earlier allows remote attackers to execute arbitrary SQL commands via the ShowPending parameter. NOTE: the vendor disputes this issue, stating "We were unable to replicate it, and the individual that reported it retracted...

CVE-2013-3525

CVE-2013-3525 affects Request Tracker (RT) versions 4.0.10 and earlier in the Approvals/ section, where a SQL injection via the ShowPending parameter could allow remote command execution. The issue is consistently described across sources as a SQL injection vulnerability; the vendor disputes repl...

Request Tracker - ShowPending SQL Injection

Request Tracker - ShowPending SQL Injection source: https://www.securityfocus.com/bid/59022/info Request Tracker is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input before using it in an SQL query. Exploiting this issue could allow an attacker ...