CVE-2011-5072 in Support Incident Tracker
Summary
by MITRE
Multiple SQL injection vulnerabilities in Support Incident Tracker (aka SiT!) before 3.65 allow remote attackers to execute arbitrary SQL commands via the (1) start parameter to portal/kb.php; (2) contractid parameter to contract_add_service.php; (3) id parameter to edit_escalation_path.php; (4) unlock, (5) lock, or (6) selected parameter to holding_queue.php; inc parameter in a report action to (7) report_customers.php or (8) report_incidents_by_site.php; (9) start parameter to search.php; or (10) sites parameter to transactions.php.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 01/18/2025
The vulnerability identified as CVE-2011-5072 represents a critical SQL injection flaw affecting the Support Incident Tracker (SiT!) software version 3.64 and earlier. This vulnerability stems from inadequate input validation and sanitization within multiple script files that process user-supplied parameters without proper escaping or parameterization. The affected parameters span across various functional modules including knowledge base management, contract services, escalation path editing, queue management, reporting functionalities, and search operations. The vulnerability allows remote attackers to manipulate database queries through specifically crafted input values that bypass normal security controls.
The technical implementation of this vulnerability manifests through direct insertion of malicious SQL code into database queries via HTTP parameters. When the application processes parameters such as start, contractid, id, unlock, lock, selected, inc, or sites, it incorporates these values directly into SQL statements without proper sanitization. This creates an opportunity for attackers to inject arbitrary SQL commands that execute with the privileges of the database user account under which the SiT! application operates. The attack vector is entirely remote and requires no authentication, making it particularly dangerous as it can be exploited by anyone with access to the vulnerable system.
The operational impact of this vulnerability extends beyond simple data theft or modification. Attackers can leverage these injection points to gain complete control over the database backend, potentially leading to data exfiltration, unauthorized access to customer information, modification of service contracts, or even complete system compromise. The vulnerability affects multiple entry points within the application, increasing the attack surface and providing attackers with multiple opportunities to exploit the system. Organizations using SiT! versions prior to 3.65 face significant risk of unauthorized data access, service disruption, and potential compliance violations due to the exposure of sensitive customer and operational data.
Security mitigations for this vulnerability should focus on immediate patching of the SiT! application to version 3.65 or later, which contains the necessary input validation fixes. Additionally, implementing proper parameterized queries and input sanitization across all user-supplied parameters would prevent similar vulnerabilities from occurring in the future. Organizations should also consider implementing web application firewalls to monitor for suspicious SQL injection patterns and establish comprehensive database access logging to detect unauthorized activities. The vulnerability aligns with CWE-89 which specifically addresses SQL injection flaws, and represents a clear violation of the principle of least privilege and secure coding practices. From an ATT&CK framework perspective, this vulnerability maps to techniques involving command and control through database manipulation and privilege escalation within the application's data layer, highlighting the need for robust database security controls and regular security assessments of third-party applications.