CVE-2013-3525
Summary
| CVE | CVE-2013-3525 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2013-05-10 21:55:02 UTC |
| Updated | 2026-04-29 01:13:23 UTC |
| Description | SQL injection vulnerability in Approvals/ in Request Tracker (RT) 4.0.10 and earlier allows remote attackers to execute arbitrary SQL commands via the ShowPending parameter. NOTE: the vendor disputes this issue, stating "We were unable to replicate it, and the individual that reported it retracted their report," and "we had verified that the claimed exploit did not function according to the author's claims. |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
LowAuthentication
NoneConfidentiality
PartialIntegrity
PartialAvailability
PartialAV:N/AC:L/Au:N/C:P/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Bestpractical | Request Tracker | 3.6.10 | All | All | All |
| Application | Bestpractical | Request Tracker | 3.6.11 | All | All | All |
| Application | Bestpractical | Request Tracker | 3.6.8 | All | All | All |
| Application | Bestpractical | Request Tracker | 3.8.10 | All | All | All |
| Application | Bestpractical | Request Tracker | 3.8.11 | All | All | All |
| Application | Bestpractical | Request Tracker | 3.8.12 | All | All | All |
| Application | Bestpractical | Request Tracker | 3.8.13 | All | All | All |
| Application | Bestpractical | Request Tracker | 3.8.14 | All | All | All |
| Application | Bestpractical | Request Tracker | 3.8.15 | All | All | All |
| Application | Bestpractical | Request Tracker | 3.8.16 | All | All | All |
| Application | Bestpractical | Request Tracker | 3.8.3 | All | All | All |
| Application | Bestpractical | Request Tracker | 3.8.4 | All | All | All |
| Application | Bestpractical | Request Tracker | 3.8.7 | All | All | All |
| Application | Bestpractical | Request Tracker | 3.8.9 | All | All | All |
| Application | Bestpractical | Request Tracker | 4.0.0 | All | All | All |
| Application | Bestpractical | Request Tracker | 4.0.1 | All | All | All |
| Application | Bestpractical | Request Tracker | 4.0.2 | All | All | All |
| Application | Bestpractical | Request Tracker | 4.0.3 | All | All | All |
| Application | Bestpractical | Request Tracker | 4.0.4 | All | All | All |
| Application | Bestpractical | Request Tracker | 4.0.5 | All | All | All |
| Application | Bestpractical | Request Tracker | 4.0.6 | All | All | All |
| Application | Bestpractical | Request Tracker | 4.0.7 | All | All | All |
| Application | Bestpractical | Request Tracker | 4.0.8 | All | All | All |
| Application | Bestpractical | Request Tracker | All | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Best Practical: On our security policies | af854a3a-2127-422b-91ae-364da2661108 | blog.bestpractical.com | |
| No Results Found ≈ Packet Storm | af854a3a-2127-422b-91ae-364da2661108 | packetstormsecurity.com | |
| IBM X-Force Exchange | af854a3a-2127-422b-91ae-364da2661108 | exchange.xforce.ibmcloud.com | |
| RT: Request Tracker 4.0.10 SQL Injection - CXSecurity.com | af854a3a-2127-422b-91ae-364da2661108 | cxsecurity.com | Exploit |
| Request Tracker 'ShowPending' Parameter SQL Injection Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | Exploit |
| osvdb.org/92265 | af854a3a-2127-422b-91ae-364da2661108 | osvdb.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.