Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
2DescriptionCVE.org
GestSup versions prior to 3.2.60 contain a SQL injection vulnerability in ticket creation functionality. User-controlled input provided during ticket creation is incorporated into SQL queries without sufficient neutralization, allowing an authenticated attacker to manipulate database queries. Successful exploitation can result in unauthorized access to or modification of database contents depending on database privileges.
AnalysisAI
GestSup prior to version 3.2.60 is vulnerable to SQL injection in the ticket creation feature, allowing authenticated attackers to execute arbitrary database queries through unsanitized user input. An attacker with valid credentials can read or modify sensitive database contents depending on the database permission level. No patch is currently available.
Technical ContextAI
Classified as CWE-89 (SQL Injection). Affects the ticket creation component of Gestsup. GestSup versions prior to 3.2.60 contain a SQL injection vulnerability in ticket creation functionality. User-controlled input provided during ticket creation is incorporated into SQL queries without sufficient neutralization, allowing an authenticated attacker to manipulate database queries. Successful exploitation can result in unauthorized access to or modification of database contents depending on database privileges.
RemediationAI
Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.
Gestsup before 3.2.10 allows account takeover through the password recovery functionality (remote). Rated critical sever
GestSup through version 3.2.60 fails to implement CSRF protections, enabling attackers to forge requests that execute ac
GestSup versions before 3.2.60 allow authenticated attackers to execute SQL injection attacks through insufficiently san
Authenticated attackers can exploit SQL injection in GestSup's search functionality (versions before 3.2.60) to manipula
GestSup before version 3.2.60 contains a pre-authentication stored XSS vulnerability in API error logging that allows un
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today