PT-2014-6172

CVE-2014-4858

·

Published

2014-07-26

·

Updated

2015-10-06

Description by

CVSS 2.0
7.5
High
MetricsAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions Sabre AirCentre Crew products version 2010.2.12.20008 and earlier
Description The issue concerns SQL injection vulnerabilities in the CWPLogin.aspx file of Sabre AirCentre Crew products. Remote attackers can execute arbitrary SQL commands by manipulating the username or password fields.
Recommendations For versions 2010.2.12.20008 and earlier, update to a version that contains a fix for this issue to prevent SQL injection attacks.
Exploitability
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')
Related identifiers
CVE-2014-4858
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com