CVE-2017-6550

Critical

Published: 20/03/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

Multiple SQL injection vulnerabilities in Kinsey Infor-Lawson (formerly ESBUS) allow remote attackers to execute arbitrary SQL commands. The attack can be conducted via the TABLE or QUERY parameters.

Risk Assessment

These vulnerabilities may lead to unauthorized access and modification of data, posing a serious threat to the integrity and confidentiality of information within the organization.

Recommendation

It is recommended to update Kinsey Infor-Lawson software to the latest version and implement appropriate security measures against SQL injection.

Original NVD description (English source)

Multiple SQL injection vulnerabilities in Kinsey Infor-Lawson (formerly ESBUS) allow remote attackers to execute arbitrary SQL commands via the (1) TABLE parameter to esbus/servlet/GetSQLData or (2) QUERY parameter to KK_LS9ReportingPortal/GetData.