CVE-2013-3525

SQL injection vulnerability in Approvals/ in Request Tracker (RT) 4.0.10 and earlier allows remote attackers to execute arbitrary SQL commands via the ShowPending parameter. NOTE: the vendor disputes this issue, stating "We were unable to replicate it, and the individual that reported it retracted their report," and "we had verified that the claimed exploit did not function according to the author's claims.

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

2.81% chance of exploitation in the next 30 days, 86th percentile

Published

2013-05-10

Updated

2024-08-06

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/38459

References

• CVE Record
• NVD entry

Related

• CVE-2013-3524
• CVE-2013-3526
• CVE-2013-3522
• CVE-2013-3527
• CVE-2013-3520
• CVE-2013-3528