Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2011-3831: Support Incident Tracker 3.65 allows database commands via file upload

CVE-2011-3831 · published 14 years ago

Summary

The Support Incident Tracker version 3.65 lets an attacker send a specially crafted file name when uploading an attachment, causing the system to run unwanted database commands. This could let an attacker read, change, or delete data stored by the tracker. Apply the vendor's security update or restrict file upload names and limit database permissions until the fix is installed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
sitracker	support_incident_tracker	3.65 `cpe:2.3:a:sitracker:support_incident_tracker:3.65:::::::*`

Original advisory text

SQL injection vulnerability in incident_attachments.php in Support Incident Tracker (aka SiT!) 3.65 allows remote attackers to execute arbitrary SQL commands via an uploaded file with a crafted fil...

References

http://secunia.com/advisories/45453 Vendor Advisory
http://secunia.com/secunia_research/2011-77/ Vendor Advisory
http://www.kb.cert.org/vuls/id/576355 US Government Resource
http://www.osvdb.org/77001
http://www.securityfocus.com/bid/50632 Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/71235

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Exploitation

2% chance of attack within 30 days

Type

CWE-89SQL Injection

Timeline

Published29 Jan 2012

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2011-3831 · NVD

Track software like this

Free during beta