Martin Herfurt

Researcher fromn.runs professionals GmbH

#21022of 60,590

15Total CVSS

Vulnerabilities · 2

High

2

The issue allows remote attackers to execute arbitrary SQL commands via a crafted envelope tag in a "mc issue attachment get" SOAP request. This is due to a SQL injection vulnerability in the mci file get function in api/soap/mc file api.php.

The issue affects the UpdateRequestHandler for XSLT or XPathEntityProcessor, allowing remote attackers to have an impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.