high7.5
CVE-2014-4858
Multiple SQL injection vulnerabilities in CWPLogin.aspx in Sabre AirCentre Crew products 2010.2.12.20008 and earlier allow remote attackers to execute arbitrar…
Impact
Multiple SQL injection vulnerabilities in CWPLogin.aspx in Sabre AirCentre Crew products 2010.2.12.20008 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password field.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sabreairlinesolutions | Crew Management | through 2010.2.12.20008 |
| Sabreairlinesolutions | Crew Operations | through 2010.2.12.20008 |
| Sabreairlinesolutions | Crew Planning | through 2010.2.12.20008 |
| Sabreairlinesolutions | Crew Services | through 2010.2.12.20008 |
| Sabreairlinesolutions | Crew Training | through 2010.2.12.20008 |