GitHub Advisoryadvisory · Packagist

GHSA-r64j-5w3w-fp49 TeamPass vulnerable to SQL Injection

CRITICAL Published 2022-05-17 Modified 2025-04-22 Official page ↗
Aliases
CVE-2015-7564
Ecosystem
Packagist
Packages
nilsteampassnet/teampass
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Reviewed
2025-04-22

Affected packages

• Packagist nilsteampassnet/teampass: < 2.1.25 → fixed in 2.1.25

Description

Multiple SQL injection vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in an action_on_quick_icon action to item.query.php or the (2) order or (3) direction parameter in an (a) connections_logs, (b) errors_logs or (c) access_logs action to view.query.php.

Related

Alias · CVE (1)

  • CVE-2015-7564 Multiple SQL injection vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to execute arbitrary SQL commands via the (1)… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References