CVE-2015-2146

CRITICAL

phpBugTracker < 1.6.0 - SQL Injection via Multiple Parameters

Title source: llm
STIX 2.1

Description

Multiple SQL injection vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to project.php, the (2) group_id parameter to group.php, the (3) status_id parameter to status.php, the (4) resolution_id parameter to resolution.php, the (5) severity_id parameter to severity.php, the (6) priority_id parameter to priority.php, the (7) os_id parameter to os.php, or the (8) site_id parameter to site.php.

References (2)

Core 2
Core References
Third Party Advisory x_refsource_confirm
https://github.com/a-v-k/phpBugTracker/issues/4
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2015/02/28/1

Scores

CVSS v3 9.8
EPSS 0.0139
EPSS Percentile 69.5%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-89
Status published
Products (1)
phpbugtracker_project/phpbugtracker < 1.6.0
Published Oct 06, 2017
Tracked Since Feb 18, 2026