Description
SQL injection vulnerability in the get_active_session function in the KTAPI_UserSession class in webservice/clienttools/services/mdownload.php in KnowledgeTree 3.7.0.2 and earlier allows remote attackers to execute arbitrary SQL commands via the u parameter, related to the getFileName function.
References (2)
Core 2
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/66988
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/531886/100/0/threaded
Scores
EPSS
0.0116
EPSS Percentile
64.0%
Details
CWE
CWE-89
Status
published
Products (8)
knowledgetree/knowledgetree
3.5
knowledgetree/knowledgetree
3.5.2
knowledgetree/knowledgetree
3.5.4
knowledgetree/knowledgetree
3.5.4a
knowledgetree/knowledgetree
3.6
knowledgetree/knowledgetree
3.7
knowledgetree/knowledgetree
3.7.0.1
knowledgetree/knowledgetree
< 3.7.0.2
Published
Apr 22, 2014
Tracked Since
Feb 18, 2026