PT-2018-17748

Name of the Vulnerable Software and Affected Versions Saifor CVMS HUB version 1.3.1 Description The issue allows an authenticated user to execute arbitrary SQL commands. This is achieved via multiple parameters to the "/cvms-hub/privado/seccionesmib/secciones.xhtml" API endpoint. The vulnerable...

CVE-2018-6792: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Saifor CVMS HUB 1.3.1 allow an authenticated user to execute arbitrary SQL commands via multiple parameters to the /cvms-hub/privado/seccionesmib/secciones.xhtml resource. The POST parameters are jidt118, jidt120, jidt122, jidt124, jidt126, jidt128, and...