CVE-2011-5072

Sitracker Support Incident Tracker < 3.64 - SQL Injection

Title source: rule

Description

Multiple SQL injection vulnerabilities in Support Incident Tracker (aka SiT!) before 3.65 allow remote attackers to execute arbitrary SQL commands via the (1) start parameter to portal/kb.php; (2) contractid parameter to contract_add_service.php; (3) id parameter to edit_escalation_path.php; (4) unlock, (5) lock, or (6) selected parameter to holding_queue.php; inc parameter in a report action to (7) report_customers.php or (8) report_incidents_by_site.php; (9) start parameter to search.php; or (10) sites parameter to transactions.php.

Exploits (1)

exploitdb WORKING POC
webappsphp
https://www.exploit-db.com/exploits/18444

References (4)

Scores

EPSS 0.0028
EPSS Percentile 51.7%

Details

CWE
CWE-89
Status published
Products (22)
sitracker/support_incident_tracker 3.6
sitracker/support_incident_tracker 3.21
sitracker/support_incident_tracker 3.22
sitracker/support_incident_tracker 3.22pl1
sitracker/support_incident_tracker 3.23
sitracker/support_incident_tracker 3.24 (2 CPE variants)
sitracker/support_incident_tracker 3.30 (2 CPE variants)
sitracker/support_incident_tracker 3.31
sitracker/support_incident_tracker 3.32
sitracker/support_incident_tracker 3.33
... and 12 more
Published Jan 29, 2012
Tracked Since Feb 18, 2026