Cheki

**Name of the Vulnerable Software and Affected Versions** Request Tracker (RT) versions 4.0.10 and earlier **Description** A SQL injection issue allows remote attackers to execute arbitrary SQL commands via the `ShowPending` parameter in the Approvals/ section. The vendor disputes this issue, stating they were unable to replicate it and the individual who reported it retracted their report. **Recommendations** For versions 4.0.10 and earlier, as a temporary workaround, consider restricting access to the Approvals/ section until the issue is resolved. Avoid using the `ShowPending` parameter in the affected section until the issue is addressed. At the moment, there is no information about a newer version that contains a fix for this issue.