OTRS and OTRS ITSM CVE-2013-4717 Unspecified SQL Injection Vulnerabilitiy

Bugtraq ID:	61037
Class:	Input Validation Error
CVE:	CVE-2013-4717
Remote:	No
Local:	Yes
Published:	Jul 09 2013 12:00AM
Updated:	Aug 14 2013 04:06PM
Credit:	The vendor reported this issue.
Vulnerable:	OTRS OTRS 3.0.10 OTRS OTRS 3.0.7 OTRS OTRS 3.0.6 OTRS OTRS 3.0.5 OTRS OTRS 3.0.4 OTRS OTRS 3.0.3 OTRS OTRS 3.0.2 OTRS OTRS 3.0.1 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:

OTRS and OTRS ITSM CVE-2013-4717 Unspecified SQL Injection Vulnerabilitiy

OTRS and OTRS ITSM are prone to an unspecified SQL-injection vulnerability because they fail to sufficiently sanitize user-supplied data.

An attacker can exploit this issue by manipulating the SQL query logic to carry out unauthorized actions on the underlying database.

The following are vulnerable:

Versions prior to OTRS 3.0.22, 3.1.18, and 3.2.9

Versions prior to OTRS ITSM 3.0.9, 3.1.10, and 3.2.7

OTRS and OTRS ITSM CVE-2013-4717 Unspecified SQL Injection Vulnerabilitiy

An attacker can exploit this issue using a web browser.

OTRS and OTRS ITSM CVE-2013-4717 Unspecified SQL Injection Vulnerabilitiy

Solution:
Updates are available. Please see the references or vendor advisory for more information.

OTRS and OTRS ITSM CVE-2013-4717 Unspecified SQL Injection Vulnerabilitiy

References:

• OTRS Homepage (OTRS)