CVE-2012-0939 - Vulnerability Details - OpenCVE

Multiple SQL injection vulnerabilities in TestLink 1.8.5b and earlier allow remote authenticated users with the Requirement view permission to execute arbitrary SQL commands via the req_spec_id parameter to (1) reqSpecAnalyse.php, (2) reqSpecPrint.php, or (3) reqSpecView.php in requirements/. NOTE: some of these details are obtained from third party information.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Testlink	Testlink

Configuration 1 [-]

OR	cpe:2.3:a:testlink:testlink:1.8.5b:::::::*
	cpe:2.3:a:testlink:testlink:1.9.3:::::::*

No data.

References

Link	Providers
http://archives.neohapsis.com/archives/bugtraq/2012-02/0104.html
http://osvdb.org/79447
http://osvdb.org/79448
http://osvdb.org/79449
http://secunia.com/advisories/48054
http://www.securityfocus.com/bid/52086
https://exchange.xforce.ibmcloud.com/vulnerabilities/73389

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2014-08-14T14:00:00

Updated: 2024-08-06T18:45:25.925Z

Reserved: 2012-01-31T00:00:00

Link: CVE-2012-0939

Vulnrichment

No data.

NVD

Status : Modified

Published: 2014-08-14T14:55:04.680

Modified: 2024-11-21T01:36:00.780

Link: CVE-2012-0939

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2012-02-20T00:00:00", "descriptions": [{"lang": "en", "value": "Multiple SQL injection vulnerabilities in TestLink 1.8.5b and earlier allow remote authenticated users with the Requirement view permission to execute arbitrary SQL commands via the req_spec_id parameter to (1) reqSpecAnalyse.php, (2) reqSpecPrint.php, or (3) reqSpecView.php in requirements/. NOTE: some of these details are obtained from third party information."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-08-28T12:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "20120220 SQL Injection Vulnerabilities in TestLink", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://archives.neohapsis.com/archives/bugtraq/2012-02/0104.html"}, {"name": "48054", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/48054"}, {"name": "79447", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/79447"}, {"name": "79448", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/79448"}, {"name": "testlink-multiple-parameters-sql-injection(73389)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/73389"}, {"name": "52086", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/52086"}, {"name": "79449", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/79449"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2012-0939", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Multiple SQL injection vulnerabilities in TestLink 1.8.5b and earlier allow remote authenticated users with the Requirement view permission to execute arbitrary SQL commands via the req_spec_id parameter to (1) reqSpecAnalyse.php, (2) reqSpecPrint.php, or (3) reqSpecView.php in requirements/. NOTE: some of these details are obtained from third party information."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "20120220 SQL Injection Vulnerabilities in TestLink", "refsource": "BUGTRAQ", "url": "http://archives.neohapsis.com/archives/bugtraq/2012-02/0104.html"}, {"name": "48054", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/48054"}, {"name": "79447", "refsource": "OSVDB", "url": "http://osvdb.org/79447"}, {"name": "79448", "refsource": "OSVDB", "url": "http://osvdb.org/79448"}, {"name": "testlink-multiple-parameters-sql-injection(73389)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/73389"}, {"name": "52086", "refsource": "BID", "url": "http://www.securityfocus.com/bid/52086"}, {"name": "79449", "refsource": "OSVDB", "url": "http://osvdb.org/79449"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T18:45:25.925Z"}, "title": "CVE Program Container", "references": [{"name": "20120220 SQL Injection Vulnerabilities in TestLink", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://archives.neohapsis.com/archives/bugtraq/2012-02/0104.html"}, {"name": "48054", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/48054"}, {"name": "79447", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/79447"}, {"name": "79448", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/79448"}, {"name": "testlink-multiple-parameters-sql-injection(73389)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/73389"}, {"name": "52086", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/52086"}, {"name": "79449", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/79449"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2012-0939", "datePublished": "2014-08-14T14:00:00", "dateReserved": "2012-01-31T00:00:00", "dateUpdated": "2024-08-06T18:45:25.925Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:testlink:testlink:1.8.5b:*:*:*:*:*:*:*", "matchCriteriaId": "2B01B9C1-A822-4647-A8D8-AD256F7BE864", "vulnerable": true}, {"criteria": "cpe:2.3:a:testlink:testlink:1.9.3:*:*:*:*:*:*:*", "matchCriteriaId": "94BC9CCB-C09F-4E3C-9FC8-3835726ACD12", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Multiple SQL injection vulnerabilities in TestLink 1.8.5b and earlier allow remote authenticated users with the Requirement view permission to execute arbitrary SQL commands via the req_spec_id parameter to (1) reqSpecAnalyse.php, (2) reqSpecPrint.php, or (3) reqSpecView.php in requirements/. NOTE: some of these details are obtained from third party information."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de inyecci\u00f3n SQL en TestLink 1.8.5b y anteriores permiten a usuarios remotos autenticados con el permiso de visualizaci\u00f3n Requirement ejecutar comandos SQL arbitrarios a trav\u00e9s del par\u00e1metro req_spec_id en (1) reqSpecAnalyse.php, (2) reqSpecPrint.php, o (3) reqSpecView.php en requirements/. NOTA: algunos de estos detalles se obtienen de informaci\u00f3n de tercera partes."}], "id": "CVE-2012-0939", "lastModified": "2024-11-21T01:36:00.780", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2014-08-14T14:55:04.680", "references": [{"source": "cve@mitre.org", "url": "http://archives.neohapsis.com/archives/bugtraq/2012-02/0104.html"}, {"source": "cve@mitre.org", "url": "http://osvdb.org/79447"}, {"source": "cve@mitre.org", "url": "http://osvdb.org/79448"}, {"source": "cve@mitre.org", "url": "http://osvdb.org/79449"}, {"source": "cve@mitre.org", "url": "http://secunia.com/advisories/48054"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/52086"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/73389"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://archives.neohapsis.com/archives/bugtraq/2012-02/0104.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/79447"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/79448"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/79449"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/48054"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/52086"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/73389"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "nvd@nist.gov", "type": "Primary"}]}