SpeedTech Organization/Resource Manager up to 5.x-1.13/6.x-1.17 on Drupal sql injection

Summaryinfo

A vulnerability categorized as critical has been discovered in SpeedTech Organization and Resource Manager up to 5.x-1.13/6.x-1.17 on Drupal. The impacted element is an unknown function. Such manipulation leads to sql injection. This vulnerability is uniquely identified as CVE-2008-6383. The attack can be launched remotely. Moreover, an exploit is present. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in SpeedTech Organization and Resource Manager up to 5.x-1.13/6.x-1.17 on Drupal and classified as critical. Affected by this issue is an unknown functionality. The manipulation with an unknown input leads to a sql injection vulnerability. Using CWE to declare the problem leads to CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. CVE summarizes:

SQL injection vulnerability in SpeedTech Organization and Resource Manager (Storm) 5.x before 5.x-1.14 and 6.x before 6.x-1.18, a module for Drupal, allows remote authenticated users with storm project access to execute arbitrary SQL commands via unspecified vectors.

The weakness was disclosed 03/02/2009 (Website). The advisory is available at securityfocus.com. This vulnerability is handled as CVE-2008-6383 since 03/02/2009. The attack may be launched remotely. The successful exploitation needs a simple authentication. Technical details are unknown but an exploit is available. This vulnerability is assigned to T1505 by the MITRE ATT&CK project.

It is declared as highly functional.

Upgrading to version 5.x-1.12 eliminates this vulnerability.

The vulnerability is also documented in the databases at X-Force (47077), SecurityFocus (BID 32626†) and Secunia (SA32978†). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• SpeedTech

Name

• Organization
• Resource Manager

Version

• 5.x-1.0
• 5.x-1.1
• 5.x-1.2
• 5.x-1.3
• 5.x-1.4
• 5.x-1.5
• 5.x-1.6
• 5.x-1.7
• 5.x-1.8
• 5.x-1.9
• 5.x-1.10
• 5.x-1.11
• 5.x-1.12
• 5.x-1.13
• 6.x-1.0
• 6.x-1.1
• 6.x-1.2
• 6.x-1.3
• 6.x-1.4
• 6.x-1.5
• 6.x-1.6
• 6.x-1.7
• 6.x-1.8
• 6.x-1.9
• 6.x-1.10
• 6.x-1.11
• 6.x-1.12
• 6.x-1.13
• 6.x-1.14
• 6.x-1.15
• 6.x-1.16
• 6.x-1.17

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion