CVE-2015-2146
CriticalSummary
Multiple SQL injection vulnerabilities in phpBugTracker before version 1.7.0 allow remote attackers to execute arbitrary SQL commands through various parameters in PHP files.
Risk Assessment
Attackers may gain access to sensitive data in the database, potentially leading to loss of confidentiality and integrity of the organization's data.
Recommendation
It is recommended to update phpBugTracker to version 1.7.0 or later and review and secure the application code against SQL injection vulnerabilities.
Original NVD description (English source)
Multiple SQL injection vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to project.php, the (2) group_id parameter to group.php, the (3) status_id parameter to status.php, the (4) resolution_id parameter to resolution.php, the (5) severity_id parameter to severity.php, the (6) priority_id parameter to priority.php, the (7) os_id parameter to os.php, or the (8) site_id parameter to site.php.