GHSA-9ggp-5rf4-x7q9
Fat Free CRM vulnerable to SQL Injection
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| RubyGems | fat_free_crm | < 0.12.1 | 0.12.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
Multiple SQL injection vulnerabilities in `app/controllers/home_controller.rb` in Fat Free CRM before 0.12.1 allow remote authenticated users to execute arbitrary SQL commands via (1) the homepage timeline feature or (2) the activity feature.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2013-7225
- https://github.com/fatfreecrm/fat_free_crm/issues/300
- https://github.com/fatfreecrm/fat_free_crm/commit/078035f1ef73ed85285ac9d128c3c5f670cef066
- https://github.com/fatfreecrm/fat_free_crm/commit/d4b2de81a4d8c1b201482edcb2488ed9280a65fd
- https://github.com/fatfreecrm/fat_free_crm
- https://github.com/fatfreecrm/fat_free_crm/wiki/Fixing-security-vulnerabilities-%2827th-Dec-2013%29
- http://openwall.com/lists/oss-security/2013/12/28/2
- http://seclists.org/fulldisclosure/2013/Dec/199