CVE-2016-5048
CriticalSummary
ReadyDesk 9.1 has an SQL injection vulnerability in chat/staff/default.aspx that allows remote attackers to execute arbitrary SQL commands via the user name field.
Risk Assessment
This vulnerability could lead to unauthorized access to the database, posing a serious threat to the integrity and confidentiality of the organization's data.
Recommendation
It is recommended to update to the latest version of ReadyDesk and implement input validation to prevent SQL injection attacks.
Other vulnerabilities in ReadyDesk 9.1
See all- CVE-2016-5683High
ReadyDesk 9.1 allows local users to obtain cleartext SQL Server credentials by reading the SQL_Config.aspx file and decrypting data with a hardcoded key in the ReadyDesk.dll file.
- CVE-2016-5049High
Directory traversal vulnerability in chat/openattach.aspx in ReadyDesk 9.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the SESID parameter in conjunction with a filename in the FNAME parameter.
- CVE-2016-5050Critical
ReadyDesk 9.1 has an unrestricted file upload vulnerability in chat/sendfile.aspx that allows remote attackers to execute arbitrary code by uploading and requesting a .aspx file.
Original NVD description (English source)
SQL injection vulnerability in chat/staff/default.aspx in ReadyDesk 9.1 allows remote attackers to execute arbitrary SQL commands via the user name field.