Description
SQL injection vulnerability in CA Clever Path Portal allows remote authenticated users to execute limited SQL commands and retrieve arbitrary database contents via (1) the ofinterest parameter in a light search query, (2) description parameter in the advanced search query, and possibly other vectors.
References
- http://www.hacktics.com/AdvCleverPathApr07.html
- ADV-2007-1544 vdb-entry
- 20070424 Security Advisory: CA CleverPath SQL Injection mailing-list
- 23671 vdb-entry
- http://supportconnectw.ca.com/public/cp/portal/infodocs/portal-secnot.asp
- 20070424 Security Advisory: CA CleverPath SQL Injection mailing-list
- 25002 third-party-advisory
- 1017970 vdb-entry
- 34128 vdb-entry
- ca-cpp-search-sql-injection(33853) vdb-entry
- http://www.ca.com/us/securityadvisor/newsinfo/collateral.aspx?cid=136879