CVE-2014-5308
HighSummary
Multiple SQL injection vulnerabilities in TestLink 1.9.11 allow remote authenticated users to execute arbitrary SQL commands via the (1) name parameter in a Search action to lib/project/projectView.php or (2) id parameter to lib/events/eventinfo.php.
Risk Assessment
An attacker could exploit these vulnerabilities to gain access to sensitive data or manipulate the database, potentially leading to serious security implications for the organization.
Recommendation
It is recommended to update TestLink to the latest version and implement appropriate security measures against SQL injection, such as input validation and sanitization.
Other vulnerabilities in TestLink 1.9.11
See all- CVE-2014-8081High
The execSetResults.php file in TestLink before version 1.9.13 has a vulnerability that allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the filter_result_result parameter.
- CVE-2015-7390Critical
CVE-2015-7390 in TestLink before version 1.9.14 has an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands via the apikey parameter in lnl.php.
- CVE-2026-70561Medium
A vulnerability in TestLink 1.9.20 and earlier is an insecure direct object reference (IDOR) that allows any authenticated user, including guest accounts, to read arbitrary attachments by supplying an integer attachment ID to the attachmentdownload.php handler without project or role authorization checks. Attackers can enumerate sequential IDs to retrieve files from private projects.
Original NVD description (English source)
Multiple SQL injection vulnerabilities in TestLink 1.9.11 allow remote authenticated users to execute arbitrary SQL commands via the (1) name parameter in a Search action to lib/project/projectView.php or (2) id parameter to lib/events/eventinfo.php.