CVE-2013-7225

Multiple SQL injection vulnerabilities in app/controllers/home_controller.rb in Fat Free CRM before 0.12.1 allow remote authenticated users to execute arbitrary SQL commands via (1) the homepage timeline feature or (2) the activity feature.

Score

CVSS 2.0 6.5 Medium

Status

Modified - cve@mitre.org

Published

2014-01-02

Last modified

2024-08-06

Weaknesses

CWE-89

Affected products

• Fat Free Crm (Fatfreecrm)

References

• http://openwall.com/lists/oss-security/2013/12/28/2
• http://seclists.org/fulldisclosure/2013/Dec/199
• http://www.phenoelit.org/stuff/ffcrm.txt
• https://github.com/fatfreecrm/fat_free_crm/commit/078035f1ef73ed85285ac9d128c3c5f670cef066
• https://github.com/fatfreecrm/fat_free_crm/commit/d4b2de81a4d8c1b201482edcb2488ed9280a65fd
• https://github.com/fatfreecrm/fat_free_crm/issues/300
• https://github.com/fatfreecrm/fat_free_crm/wiki/Fixing-security-vulnerabilities-%2827th-Dec-2013%29