GitHub Advisoryadvisory · RubyGems

GHSA-9ggp-5rf4-x7q9 Fat Free CRM vulnerable to SQL Injection

MEDIUM Published 2022-05-17 Modified 2023-01-23 Official page ↗
Aliases
CVE-2013-7225
Ecosystem
RubyGems
Packages
fat_free_crm
Severity
Moderate
Weaknesses
CWE-89
Reviewed
2023-01-23

Affected packages

• RubyGems fat_free_crm: < 0.12.1 → fixed in 0.12.1

Description

Multiple SQL injection vulnerabilities in `app/controllers/home_controller.rb` in Fat Free CRM before 0.12.1 allow remote authenticated users to execute arbitrary SQL commands via (1) the homepage timeline feature or (2) the activity feature.

Related

Alias · CVE (1)

  • CVE-2013-7225 Multiple SQL injection vulnerabilities in app/controllers/home_controller.rb in Fat Free CRM before 0.12.1 allow remote authenticated users… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References