CVE-2011-5072

Support Incident Tracker < 3.65 - SQL Injection via Multiple Parameters

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2011-5072.

AI-analyzed exploit summary The provided code contains multiple functional proof-of-concept exploits for SQL injection and cross-site scripting vulnerabilities in SiT! Support Incident Tracker. It includes detailed HTTP request examples and payloads for various endpoints.

Description

Multiple SQL injection vulnerabilities in Support Incident Tracker (aka SiT!) before 3.65 allow remote attackers to execute arbitrary SQL commands via the (1) start parameter to portal/kb.php; (2) contractid parameter to contract_add_service.php; (3) id parameter to edit_escalation_path.php; (4) unlock, (5) lock, or (6) selected parameter to holding_queue.php; inc parameter in a report action to (7) report_customers.php or (8) report_incidents_by_site.php; (9) start parameter to search.php; or (10) sites parameter to transactions.php.

Exploits (1)

exploitdb WORKING POC
webappsphp
https://www.exploit-db.com/exploits/18444

The provided code contains multiple functional proof-of-concept exploits for SQL injection and cross-site scripting vulnerabilities in SiT! Support Incident Tracker. It includes detailed HTTP request examples and payloads for various endpoints.

Classification
Working Poc 100%
Attack Type
Sqli | Xss
Complexity
Trivial
Reliability
Reliable
Target: SiT! Support Incident Tracker
No auth needed
Prerequisites: Access to the target application
devstral-2 · analyzed Feb 19, 2026 Full analysis →

References (4)

Core 4
Core References
Third Party Advisory x_refsource_confirm
http://sitracker.org/wiki/ReleaseNotes365
Exploit mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/519636
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/46019

Scores

EPSS 0.0111
EPSS Percentile 61.5%

Details

CWE
CWE-89
Status published
Products (22)
sitracker/support_incident_tracker 3.6
sitracker/support_incident_tracker 3.21
sitracker/support_incident_tracker 3.22
sitracker/support_incident_tracker 3.22pl1
sitracker/support_incident_tracker 3.23
sitracker/support_incident_tracker 3.24 (2 CPE variants)
sitracker/support_incident_tracker 3.30 (2 CPE variants)
sitracker/support_incident_tracker 3.31
sitracker/support_incident_tracker 3.32
sitracker/support_incident_tracker 3.33
... and 12 more
Published Jan 29, 2012
Tracked Since Feb 18, 2026