Skip to content
OpenAdvisories
Unscored CVE-2014-2737 EUVD-2014-2765GHSA-qc9q-6588-8mr6

SQL injection vulnerability in the get_active_session function in the KTAPI_UserSession class in webservice/clienttools/services/mdownload.…

Published Apr 22, 2014 · Updated Aug 6, 2024 · Assigned by mitre

Description

SQL injection vulnerability in the get_active_session function in the KTAPI_UserSession class in webservice/clienttools/services/mdownload.php in KnowledgeTree 3.7.0.2 and earlier allows remote attackers to execute arbitrary SQL commands via the u parameter, related to the getFileName function.

References