Unscored CVE-2015-6004 EUVD-2015-5947GHSA-q7r8-6fcq-p76p

Multiple SQL injection vulnerabilities in IPSwitch WhatsUp Gold before 16.4 allow remote attackers to execute arbitrary SQL commands via (1…

Published Dec 27, 2015 · Updated Aug 6, 2024 · Assigned by certcc

Description

Multiple SQL injection vulnerabilities in IPSwitch WhatsUp Gold before 16.4 allow remote attackers to execute arbitrary SQL commands via (1) the UniqueID (aka sUniqueID) parameter to WrFreeFormText.asp in the Reports component or (2) the Find Device parameter.

References

VU#176160 third-party-advisory
http://twitter.com/ipswitch/statuses/677558623229317121
1034833 vdb-entry
https://community.rapid7.com/community/infosec/blog/2015/12/16/multiple-disclosures-for-multiple-network-management-systems
79506 vdb-entry