NetSight
IP …
critical9.8

CVE-2016-4999

SQL injection vulnerability in the getStringParameterSQL method in main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java in Dashbuilder before…

Impact

SQL injection vulnerability in the getStringParameterSQL method in main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java in Dashbuilder before 0.6.0.Beta1 allows remote attackers to execute arbitrary SQL commands via a data set lookup filter in the (1) Data Set Authoring or (2) Displayer editor UI.

Affected products

VendorProductAffected versions
RedhatDashbuilder
through 0.5.0
RedhatJboss Bpm Suite
Versions 6.0.0, 6.0.1, 6.0.3, 6.1, 6.1.2
RedhatJboss Enterprise Brms Platform
Versions 5.0.0, 5.3.1, 6.0.0, 6.0.1, 6.0.2, 6.0.3

Weakness classification

CWE-89

References