CVE-2010-1733

OCS Inventory NG < 1.02.3 - SQL Injection via Search Form Fields

Title source: llm
STIX 2.1

Description

Multiple SQL injection vulnerabilities in OCS Inventory NG before 1.02.3 allow remote attackers to execute arbitrary SQL commands via (1) multiple inventory fields to the search form, reachable through index.php; or (2) the "Software name" field to the "All softwares" search form, reachable through index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

References (4)

Core 4
Core References
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/38311
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2010:178
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/55873
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/61942

Scores

EPSS 0.0102
EPSS Percentile 59.9%

Details

CWE
CWE-89
Status published
Products (4)
ocsinventory-ng/ocs_inventory_ng 1.0 beta (5 CPE variants)
ocsinventory-ng/ocs_inventory_ng 1.01
ocsinventory-ng/ocs_inventory_ng 1.02 (5 CPE variants)
ocsinventory-ng/ocs_inventory_ng < 1.02.1
Published May 06, 2010
Tracked Since Feb 18, 2026