ID:5927 - Exploit for SQL injection - CVE-2018-7765
Published: June 17, 2021
Vulnerability identifier: #VU11652
Vulnerability risk: Low
CVE-ID: CVE-2018-7765
CWE-ID: CWE-89
Exploitation vector: Remote access
Vulnerable software:
Link to public exploit:
Vulnerability description
The vulnerability allows a remote attacker to execute arbitrary SQL commands in web application database.
The weakness exists within processing of track_import_export.php due to insufficient sanitization of user-supplied data. A remote attacker can submit a specially crafted object_id input parameter to vulnerable script and execute arbitrary SQL commands in web application database.
Remediation
Install update from vendor's website.