製品・ソフトウェアに関する情報

Vulnerability Search

ベンダー検索

Product/Service Search

JVN Vulnerability Search Top

->

JVN脆弱性詳細

TestLink における SQL インジェクションの脆弱性

Title	TestLink における SQL インジェクションの脆弱性
Summary	TestLink には、SQL インジェクションの脆弱性が存在します。
Possible impacts	リモート認証されたユーザにより、(1) lib/project/projectView.php の Search アクションの name パラメータ、または (2) lib/events/eventinfo.php の id パラメータを介して、任意の SQL コマンドを実行される可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	Aug. 1, 2014, midnight
Registration Date	Oct. 10, 2014, 4:58 p.m.
Last Update	Oct. 10, 2014, 4:58 p.m.

CVSS2.0 : 危険
Score	9
Vector	AV:N/AC:L/Au:S/C:C/I:C/A:C

Affected System

TestLink Development Team

TestLink 1.9.11

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2014-5308	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5308
National Vulnerability Database (NVD)
2	CVE-2014-5308	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-5308

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-89	https://jvndb.jvn.jp/ja/cwe/CWE-89.html

ベンダー情報

No	Name	URL
Gitorious
1	testlink：sql injection	https://gitorious.org/testlink-ga/testlink-code/commit/7a099737b4c739bf083df016c0a99f66dd8ac0b3
Testlink
2	Top Page	http://testlink.org/

その他

No	Name	URL
関連文書
1	TestLink 1.9.11 SQL Injection	http://packetstormsecurity.com/files/128521/TestLink-1.9.11-SQL-Injection.html

Change Log

No	Changed Details	Date of change
0	[2014年10月10日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2014-5308

Summary	Multiple SQL injection vulnerabilities in TestLink 1.9.11 allow remote authenticated users to execute arbitrary SQL commands via the (1) name parameter in a Search action to lib/project/projectView.php or (2) id parameter to lib/events/eventinfo.php.
Publication Date	Oct. 9, 2014, 2:55 a.m.
Registration Date	Jan. 26, 2021, 3:14 p.m.
Last Update	Nov. 21, 2024, 11:11 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:testlink:testlink:1.9.11:::::::*

Related information, measures and tools

No	URL	refsource	タグ
1	http://osvdb.org/show/osvdb/112524
2	http://osvdb.org/show/osvdb/112524
3	http://packetstormsecurity.com/files/128521/TestLink-1.9.11-SQL-Injection.html		Exploit
4	http://packetstormsecurity.com/files/128521/TestLink-1.9.11-SQL-Injection.html		Exploit
5	http://seclists.org/fulldisclosure/2014/Oct/11		Exploit
6	http://seclists.org/fulldisclosure/2014/Oct/11		Exploit
7	http://seclists.org/fulldisclosure/2014/Oct/13		Exploit
8	http://seclists.org/fulldisclosure/2014/Oct/13		Exploit
9	http://www.exploit-db.com/exploits/34863		Exploit
10	http://www.exploit-db.com/exploits/34863		Exploit
11	http://www.securityfocus.com/bid/70207
12	http://www.securityfocus.com/bid/70207
13	https://gitorious.org/testlink-ga/testlink-code/commit/7a099737b4c739bf083df016c0a99f66dd8ac0b3		Exploit
14	https://gitorious.org/testlink-ga/testlink-code/commit/7a099737b4c739bf083df016c0a99f66dd8ac0b3		Exploit
15	https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-5308		Exploit
16	https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-5308		Exploit

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-89	SQLインジェクション	https://cwe.mitre.org/data/definitions/89.html