CVE-2018-7466

EPSS 6.4%

install/installNewDB.php in TestLink through 1.9.16 allows remote attackers to conduct injection attacks by leveraging control over DB LOGIN NAMES data during installation to provide a long, crafted value.

Affected products

n/a · n/a

public PoCs found — 3

cve_referencewww.exploit-db.com/exploits/44226/unverified cve_referencewww.exploit-db.com/exploits/44349/unverified exploitdbwww.exploit-db.com/exploits/44226unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/TestLinkOpenSourceTRMS/testlink-code/commit/9696012eecbafb0aa21cc346234512c29b474679 https://www.exploit-db.com/exploits/44226/https://www.exploit-db.com/exploits/44349/