Description
Multiple SQL injection vulnerabilities in (a) LedgerSMB 1.0.0 through 1.2.7 and (b) DWS Systems SQL-Ledger 2.x allow remote attackers to execute arbitrary SQL commands via (1) the invoice quantity field or (2) the sort field.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | sql-ledger | No fix yet | — |
| Debian 13 | sql-ledger | No fix yet | — |
| Debian 12 | sql-ledger | No fix yet | — |
References
- 27159 third-party-advisory
- ledgersmb-unspecified-sql-injection(37032) vdb-entry
- 20071009 LedgerSMB < 1.2.8, SQL-Ledger 2.x Multiple SQL Injection Issues mailing-list
- 37865 vdb-entry
- sqlledger-unspecified-sql-injection(37033) vdb-entry
- ADV-2007-3453 vdb-entry
- 3209 third-party-advisory
- 25979 vdb-entry
- 37866 vdb-entry
- http://www.ledgersmb.org/node/54
- 27171 third-party-advisory