Multiple SQL injection vulnerabilities in the FAQ package 2.x before 2.3.6, 4.x before 4.0.5, and 5.x before 5.0.5 in Open Ticket Request System (OTRS) allow remote attackers to execute arbitrary SQL commands via crafted search parameters.
References
| Link | Resource |
|---|---|
| http://www.securityfocus.com/bid/93019 | |
| https://github.com/OTRS/FAQ/commit/3700f75c67f6ed1d39bc213445c6d12a458e1af9 | Issue Tracking Patch |
| https://github.com/OTRS/FAQ/commit/8c9d63bd0297adda760330805c31afc130861557 | Issue Tracking Patch |
| https://github.com/OTRS/FAQ/commit/b805703e7b7725d1f3040bb626a4c4dd845ee9e3 | Issue Tracking Patch |
| https://www.otrs.com/security-advisory-2016-01-security-update-otrs-faq-package/ | Vendor Advisory |
| http://www.securityfocus.com/bid/93019 | |
| https://github.com/OTRS/FAQ/commit/3700f75c67f6ed1d39bc213445c6d12a458e1af9 | Issue Tracking Patch |
| https://github.com/OTRS/FAQ/commit/8c9d63bd0297adda760330805c31afc130861557 | Issue Tracking Patch |
| https://github.com/OTRS/FAQ/commit/b805703e7b7725d1f3040bb626a4c4dd845ee9e3 | Issue Tracking Patch |
| https://www.otrs.com/security-advisory-2016-01-security-update-otrs-faq-package/ | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
No history.
Information
Published : 2016-09-17 02:59
Updated : 2025-04-12 10:46
NVD link : CVE-2016-5843
Mitre link : CVE-2016-5843
CVE.ORG link : CVE-2016-5843
JSON object : View
Products Affected
otrs
- faq
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')