CVE-2015-7564
CriticalSummary
Multiple SQL injection vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in an action_on_quick_icon action to item.query.php or the (2) order or (3) direction parameter in an (a) connections_logs, (b) errors_logs or (c) access_logs action to view.query.php.
Risk Assessment
Attackers can gain access to sensitive data in the database, potentially leading to serious security breaches and data loss.
Recommendation
It is recommended to update TeamPass to the latest version to eliminate these vulnerabilities and implement additional security measures such as input data filtering.
Original NVD description (English source)
Multiple SQL injection vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in an action_on_quick_icon action to item.query.php or the (2) order or (3) direction parameter in an (a) connections_logs, (b) errors_logs or (c) access_logs action to view.query.php.