en.securitylab.ru
http://en.securitylab.ru/lab/PT-2011-25 CVE-2011-5071
Support Incident Tracker (SiT!) 3.63 p1 - 'report_marketing.php?exc[]' SQL Injection
Record summary
CVE-2011-5071 has a selected CVSS score of 7.5; EIP currently links 4 catalogued exploits.
Description
Multiple SQL injection vulnerabilities in Support Incident Tracker (aka SiT!) before 3.64 allow remote attackers to execute arbitrary SQL commands via the (1) exc[] parameter to report_marketing.php, (2) selected[] parameter to tasks.php, (3) sites[] parameter to billable_incidents.php, or (4) search_string parameter to search.php. NOTE: some of these details are obtained from third party information.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 4
Proofs of concept
4Catalogued exploits
ExploitDBSupport Incident Tracker (SiT!) 3.63 p1 - 'report_marketing.php?exc[]' SQL InjectionExploitDB exploitby Yuri GoltsevNot analyzed1 file
ExploitDBSupport Incident Tracker (SiT!) 3.63 p1 - 'billable_incidents.php?sites[]' SQL InjectionExploitDB exploitby Yuri GoltsevNot analyzed1 file
ExploitDBSupport Incident Tracker (SiT!) 3.63 p1 - 'search.php?search_string' SQL InjectionExploitDB exploitby Yuri GoltsevNot analyzed1 file
ExploitDBSupport Incident Tracker (SiT!) 3.63 p1 - 'tasks.php?selected[]' SQL InjectionExploitDB exploitby Yuri GoltsevNot analyzed1 file
References
620110726 [PT-2011-25] SQL injection vulnerabilities in Support Incident Trackermailing list
http://seclists.org/bugtraq/2011/Jul/174 45277Third-party advisory
http://secunia.com/advisories/45277 45437Third-party advisory
http://secunia.com/advisories/45437 sitracker.orgConfirmation
http://sitracker.org/wiki/ReleaseNotes364 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2011-5071