CVE-2013-3578

SQL injection vulnerability in the Help Desk application in Wave EMBASSY Remote Administration Server (ERAS) allows remote authenticated users to execute arbitrary SQL commands via the ct100$4MainController$TextBoxSearchValue parameter (aka the search field), leading to execution of operating-system commands.

Score
CVSS 2.0 9.0 Critical
Status
Modified - cret@cert.org
Published
2013-07-15
Last modified
2024-09-17
Weaknesses
CWE-78, CWE-89

Affected products

References

 
 
© AVABIS GmbH privacypolicy about