NVD Vulnerability Detail

CVE-2016-5843

Summary	Multiple SQL injection vulnerabilities in the FAQ package 2.x before 2.3.6, 4.x before 4.0.5, and 5.x before 5.0.5 in Open Ticket Request System (OTRS) allow remote attackers to execute arbitrary SQL commands via crafted search parameters.
Publication Date	Sept. 17, 2016, 11:59 a.m.
Registration Date	Jan. 26, 2021, 2:14 p.m.
Last Update	Nov. 21, 2024, 11:55 a.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://www.securityfocus.com/bid/93019
2	http://www.securityfocus.com/bid/93019
3	https://github.com/OTRS/FAQ/commit/3700f75c67f6ed1d39bc213445c6d12a458e1af9	Issue Tracking Patch
4	https://github.com/OTRS/FAQ/commit/3700f75c67f6ed1d39bc213445c6d12a458e1af9	Issue Tracking Patch
5	https://github.com/OTRS/FAQ/commit/8c9d63bd0297adda760330805c31afc130861557	Issue Tracking Patch
6	https://github.com/OTRS/FAQ/commit/8c9d63bd0297adda760330805c31afc130861557	Issue Tracking Patch
7	https://github.com/OTRS/FAQ/commit/b805703e7b7725d1f3040bb626a4c4dd845ee9e3	Issue Tracking Patch
8	https://github.com/OTRS/FAQ/commit/b805703e7b7725d1f3040bb626a4c4dd845ee9e3	Issue Tracking Patch
9	https://www.otrs.com/security-advisory-2016-01-security-update-otrs-faq-package/	Vendor Advisory
10	https://www.otrs.com/security-advisory-2016-01-security-update-otrs-faq-package/	Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-89	SQLインジェクション	https://cwe.mitre.org/data/definitions/89.html

JVN Vulnerability Information

Open Ticket Request System の FAQ パッケージにおける SQL インジェクションの脆弱性

Title	Open Ticket Request System の FAQ パッケージにおける SQL インジェクションの脆弱性
Summary	Open Ticket Request System (OTRS) の FAQ パッケージには、SQL インジェクションの脆弱性が存在します。
Possible impacts	第三者により、巧妙に細工された search パラメータを介して、任意の SQL コマンドを実行される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	June 25, 2016, midnight
Registration Date	Sept. 21, 2016, 5 p.m.
Last Update	Sept. 21, 2016, 5 p.m.

Affected System

OTRS プロジェクト

FAQ 2.3.6 未満の 2.x

FAQ 4.0.5 未満の 4.x

FAQ 5.0.5 未満の 5.x

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2016-5843	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5843
National Vulnerability Database (NVD)
2	CVE-2016-5843	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-5843

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-89	https://jvndb.jvn.jp/ja/cwe/CWE-89.html

ベンダー情報

No	Name	URL
GitHub
1	Fixed issue with not correctly quoted search parameters. (3700f75)	https://github.com/OTRS/FAQ/commit/3700f75c67f6ed1d39bc213445c6d12a458e1af9
2	Fixed issue with not correctly quoted search parameters. (8c9d63b)	https://github.com/OTRS/FAQ/commit/8c9d63bd0297adda760330805c31afc130861557
3	Fixed issue with not correctly quoted search parameters. (b805703)	https://github.com/OTRS/FAQ/commit/b805703e7b7725d1f3040bb626a4c4dd845ee9e3
Security Advisory
4	2016-01: Security Update for OTRS FAQ package	https://www.otrs.com/security-advisory-2016-01-security-update-otrs-faq-package/

Change Log

No	Changed Details	Date of change
0	[2016年09月21日] 掲載	Feb. 17, 2018, 10:37 a.m.