Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Multiple SQL injection vulnerabilities in TestLink 1.9.3, 1.8.5b, and earlier allow remote authenticated users with certain permissions to execute arbitrary SQL commands via the root_node parameter in the display_children function to (1) getrequirementnodes.php or (2) gettprojectnodes.php in lib/ajax/; the (3) cfield_id parameter in an edit action to lib/cfields/cfieldsEdit.php; the (4) id parameter in an edit action or (5) plan_id parameter in a create action to lib/plan/planMilestonesEdit.php; or the req_spec_id parameter to (6) reqImport.php or (7) in a create action to reqEdit.php in lib/requirements/. NOTE: some of these details are obtained from third party information.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
TestLink 多个SQL注入漏洞
Vulnerability Description
Testlink是TestLink团队开发的一套基于PHP的开源测试管理工具。该工具提供测试需求管理、测试用例管理和测试数据统计等功能。 TestLink 1.9.3和1.8.5b版本中存在SQL注入漏洞，该漏洞源于lib/ajax/ URL下的getrequirementnodes.php或gettprojectnodes.php脚本没有充分过滤‘display_children’函数中的root_node参数；在程序执行edit操作时，lib/cfields/cfieldsEdit.php脚本没有充分
CVSS Information
N/A
Vulnerability Type
N/A