CVE-2014-2934

High

Published: 08/05/2014(UTC)Translated: 17/06/2026(UTC)NVD NIST

Summary

Multiple SQL injection vulnerabilities in Caldera 9.20 allow remote attackers to execute arbitrary SQL commands via the tr parameter to costview2/jobs.php or costview2/printers.php.

Risk Assessment

Attackers may gain access to sensitive data or manipulate the database, potentially leading to serious security implications for the organization.

Recommendation

It is recommended to update to the latest version of Caldera and implement appropriate input validation and security measures.

Other vulnerabilities in Caldera 9.20

CVE-2014-2936High
The directory manager in Caldera 9.20 allows remote attackers to conduct variable-injection attacks in the global scope via the maindir_hotfolder parameter to dirmng/index.php or an unspecified parameter to other files.

Original NVD description (English source)

Multiple SQL injection vulnerabilities in Caldera 9.20 allow remote attackers to execute arbitrary SQL commands via the tr parameter to (1) costview2/jobs.php or (2) costview2/printers.php.