Summary
eTRAKiT is a public online portal that provides the public with easily accessible information related to permits, projects, licenses, code compliance, land, and inspections. An SQL injection vulnerability in the CRM feature of eTRAKiT.net release 3.2.1.77 allows a remote, unauthenticated attacker to execute SQL queries and potentially arbitrary operating system commands as the Microsoft SQL Server account. It is recommended that the CRM feature is turned off while on eTRAKiT.net release 3.2.1.77. eTRAKiT.Net is no longer supported, and users are recommended to migrate to the latest version of CentralSquare Community Development (24.1.1.2 as of 2025-03-13).
Vulnerabilities 1
-
Critical 9.8
Blind SQL Injection vulnerability in eTRAKiT.Net
A SQL injection issue has been discovered in eTRAKiT.net release 3.2.1.77. Due to improper input validation, a remote unauthenticated attacker can run arbitrary commands as the current MS SQL server account. It is recommended that the CRM feature is turned of…
Revision history
-
#1.0.1
Remove reference to pull request, standardize "Initial publication" revision message
-
#1.0.0
Initial publication