high7.5Public exploit code
CVE-2011-5213
Multiple SQL injection vulnerabilities in BrowserCRM 5.100.01 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) login[username] …
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- BrowserCRM 5.100.1 - 'contact_id' SQL Injection2011-12-14 · webapps · php · Verified
- BrowserCRM 5.100.1 - 'parent_id' SQL Injection2011-12-14 · webapps · php · Verified
Impact
Multiple SQL injection vulnerabilities in BrowserCRM 5.100.01 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) login[username] parameter to index.php, (2) parent_id parameter to modules/Documents/version_list.php, or (3) contact_id parameter to modules/Documents/index.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Browsercrm | Browsercrm | through 5.100.01 Versions 4.604.01, 4.605.00, 4.607.00, 4.610.00, 4.611.01 |
Weakness classification
References
- NVD record
- CVE.org record
- http://osvdb.org/77733
- http://osvdb.org/77734
- http://osvdb.org/77735
- http://secunia.com/advisories/47217
- https://exchange.xforce.ibmcloud.com/vulnerabilities/71828
- https://www.htbridge.ch/advisory/multiple_vulnerabilities_in_browser_crm.html
- http://osvdb.org/77733
- http://osvdb.org/77734
- http://osvdb.org/77735
- http://secunia.com/advisories/47217
- https://exchange.xforce.ibmcloud.com/vulnerabilities/71828
- https://www.htbridge.ch/advisory/multiple_vulnerabilities_in_browser_crm.html