CVE-2009-4238: SQL Injection

Published Dec 10, 2009

Updated

Multiple SQL injection vulnerabilities in TestLink before 1.8.5 allow remote authenticated users to execute arbitrary SQL commands via (1) the Test Case ID field to lib/general/navBar.php or (2) the logLevel parameter to lib/events/eventviewer.php.

Affected Software

15 affected components

Teamst Testlink=1.7

Teamst Testlink=1.7.1

Teamst Testlink=1.7.2

Teamst Testlink=1.7.3

Teamst Testlink=1.7.4

Teamst Testlink=1.8

Teamst Testlink=1.8-beta1

Teamst Testlink=1.8-beta2

Teamst Testlink=1.8-beta3

Teamst Testlink=1.8-rc1

Teamst Testlink=1.8.0

Teamst Testlink=1.8.1

Teamst Testlink=1.8.2

Teamst Testlink=1.8.3

Teamst Testlink=1.8.4

Remediation

Patch Available

http://www.teamst.org/index.php?option=com_content&task=view&id=84&Itemid=2

Event History

Dec 10, 2009

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2009-4238?

CVE-2009-4238 has a medium severity rating as it allows remote authenticated users to execute arbitrary SQL commands.

How do I fix CVE-2009-4238?

To fix CVE-2009-4238, you should upgrade TestLink to version 1.8.5 or later, which addresses these SQL injection vulnerabilities.

What versions of TestLink are affected by CVE-2009-4238?

CVE-2009-4238 affects TestLink versions 1.7, 1.7.1, 1.7.2, 1.7.3, 1.7.4, 1.8, and its beta and release candidates before 1.8.5.

Can I exploit CVE-2009-4238 without valid credentials?

No, CVE-2009-4238 requires valid authenticated user credentials to exploit the SQL injection vulnerabilities.

What are the potential impacts of CVE-2009-4238 on my TestLink installation?

Exploiting CVE-2009-4238 may lead to unauthorized access to the database, allowing attackers to manipulate or extract sensitive information.