ZDI-22-967: BMC Track-It! GetPopupSubQueryDetails SQL Injection Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of BMC Track-It!. Authentication is required to exploit this vulnerability. The specific flaw exists within the GetPopupSubQueryDetails endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-22-967?
The severity of ZDI-22-967 is classified as high due to its potential to disclose sensitive information.
How do I fix ZDI-22-967?
To fix ZDI-22-967, update BMC Track-It! to the latest patched version.
What is the impact of ZDI-22-967?
The impact of ZDI-22-967 allows authenticated remote attackers to disclose sensitive information from affected installations.
What type of vulnerability is ZDI-22-967?
ZDI-22-967 is a remote information disclosure vulnerability.
Which software is affected by ZDI-22-967?
BMC Track-It! is the software affected by the ZDI-22-967 vulnerability.