CVE-2013-2594

Hornbill Supportworks ITSM <3.4.14 - SQL Injection

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2013-2594. PoCs published by Joseph Sheridan.

AI-analyzed exploit summary The document describes a SQL injection vulnerability in Hornbill Supportworks ITSM's calldiary.php file, allowing attackers to execute arbitrary SQL commands and potentially write a PHP webshell to the webroot for full system control.

Description

SQL injection vulnerability in reports/calldiary.php in Hornbill Supportworks ITSM 1.0.0 through 3.4.14 allows remote attackers to execute arbitrary SQL commands via the callref parameter.

Exploits (1)

exploitdb WRITEUP
by Joseph Sheridan · textwebappsphp
https://www.exploit-db.com/exploits/25002

The document describes a SQL injection vulnerability in Hornbill Supportworks ITSM's calldiary.php file, allowing attackers to execute arbitrary SQL commands and potentially write a PHP webshell to the webroot for full system control.

Classification
Writeup 90%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: Hornbill Supportworks ITSM versions 1.0.0 and possibly other versions
No auth needed
Prerequisites: Network access to the vulnerable application
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (7)

Core 7
Core References
Exploit mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2013/Apr/232
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/92757
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/59439
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/83767
Exploit exploit x_refsource_exploit-db
http://www.exploit-db.com/exploits/25002

Scores

EPSS 0.0264
EPSS Percentile 83.6%

Details

CWE
CWE-89
Status published
Products (2)
hornbill/supportworks_itsm 1.0.0
hornbill/supportworks_itsm 3.4.14
Published Jan 21, 2014
Tracked Since Feb 18, 2026