CVE-2009-4238
10.12.2009, 23:30
Multiple SQL injection vulnerabilities in TestLink before 1.8.5 allow remote authenticated users to execute arbitrary SQL commands via (1) the Test Case ID field to lib/general/navBar.php or (2) the logLevel parameter to lib/events/eventviewer.php.
| Vendor | Product | Version |
|---|---|---|
| teamst | testlink | 1.7 |
| teamst | testlink | 1.7.1 |
| teamst | testlink | 1.7.2 |
| teamst | testlink | 1.7.3 |
| teamst | testlink | 1.7.4 |
| teamst | testlink | 1.8 |
| teamst | testlink | 1.8:beta1 |
| teamst | testlink | 1.8:beta2 |
| teamst | testlink | 1.8:beta3 |
| teamst | testlink | 1.8:rc1 |
| teamst | testlink | 1.8.0 |
| teamst | testlink | 1.8.1 |
| teamst | testlink | 1.8.2 |
| teamst | testlink | 1.8.3 |
| teamst | testlink | 1.8.4 |
𝑥
= Vulnerable software versions
References