CVE-2013-3525
Request Tracker < 4.0.9 - SQL Injection via ShowPending Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2013-3525. PoCs published by cheki.
AI-analyzed exploit summary This exploit demonstrates an SQL injection vulnerability in Request Tracker (RT) 4.0.10 by injecting a malicious payload into the 'ShowPending' parameter of a POST request. The payload manipulates the SQL query to bypass authentication or extract sensitive data.
Description
SQL injection vulnerability in Approvals/ in Request Tracker (RT) 4.0.10 and earlier allows remote attackers to execute arbitrary SQL commands via the ShowPending parameter. NOTE: the vendor disputes this issue, stating "We were unable to replicate it, and the individual that reported it retracted their report," and "we had verified that the claimed exploit did not function according to the author's claims.
Exploits (1)
This exploit demonstrates an SQL injection vulnerability in Request Tracker (RT) 4.0.10 by injecting a malicious payload into the 'ShowPending' parameter of a POST request. The payload manipulates the SQL query to bypass authentication or extract sensitive data.