Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2011-3197: Domain Technologie Control <0.34.1 lets logged‑in users run DB commands

CVE-2011-3197 · published 12 years ago

Summary

The open‑source Domain Technologie Control product, versions before 0.34.1, lets anyone with a valid login send specially crafted data that can cause the system to run unintended database commands. This could let an attacker read, change or delete information stored by the application. Upgrade to version 0.34.1 or later, or apply the vendor’s patch, and restrict access to trusted users only.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
gplhost	domain_technologie_control	<= 0.32.11 0.24.6 0.25.1 0.25.2 0.25.3 0.26.7 0.26.8 0.26.9 0.27.3 0.28.2 0.28.3 0.28.4 23 more version ranges `cpe:2.3:a:gplhost:domain_technologie_control::::::::`

Original advisory text

SQL injection vulnerability in Domain Technologie Control (DTC) before 0.34.1 allows remote authenticated users to execute arbitrary SQL commands via the addrlink parameter to shared/inc/forms/domain_info.php. NOTE: CVE-2011-3197 has been SPLIT due to findings by different researchers. CVE-2011-5272 has been assigned for the vps_note parameter to dtcadmin/logPushlet.php vector.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.5 Medium

Exploitation

1% chance of attack within 30 days

Type

CWE-89SQL Injection

Timeline

Published21 Mar 2014

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2011-3197 · NVD

Track software like this

Free during beta