SQL Injection Vulnerabilities in Fat Free CRM Software by Fat Free CRM
CVE-2013-7225

Currently unrated

Key Information:

Vendor

Fatfreecrm

Status
Fat Free Crm
Vendor
CVE Published:
2 January 2014

What is CVE-2013-7225?

Multiple SQL injection vulnerabilities exist in the app/controllers/home_controller.rb file of Fat Free CRM prior to version 0.12.1. These vulnerabilities allow remote authenticated users to execute arbitrary SQL commands through various features, particularly the homepage timeline and the activity feature. This can lead to unauthorized data exposure and manipulation, highlighting the critical need for timely software updates and security measures.

References

http://seclists.org/fulldisclosure/2013/Dec/199
mailing-listx_refsource_FULLDISC
http://openwall.com/lists/oss-security/2013/12/28/2
mailing-listx_refsource_MLIST
http://www.phenoelit.org/stuff/ffcrm.txt
x_refsource_MISC

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.