Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

Request Tracker lets signed‑in users run any database command

CVE-2011-4460 · published 14 years ago
Summary

The Request Tracker (RT) software versions 2.x, 3.x before 3.8.12, and 4.x before 4.0.6 allow a user who has already logged in to send specially crafted input that runs arbitrary commands in the underlying database. This could let an attacker change, delete, or view data they should not access. Apply the latest updates from the vendor or your distribution to bring RT to a patched version.

What to do
  • Update debian request-tracker4 to version 4.0.5-3.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian request-tracker4 < 4.0.5-3
Fix: upgrade to 4.0.5-3
– bestpractical rt 2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5
2.0.5.1
2.0.5.3
2.0.6
2.0.7
2.0.8
2.0.8.2
88 more version ranges
cpe:2.3:a:bestpractical:rt:2.0.0:*:*:*:*:*:*:*
Original advisory text
SQL injection vulnerability in Best Practical Solutions RT 2.x and 3.x before 3.8.12 and 4.x before 4.0.6 allows remote authenticated users to execute arbitrary SQL commands by leveraging access to...
SQL injection vulnerability in Best Practical Solutions RT 2.x and 3.x before 3.8.12 and 4.x before 4.0.6 allows remote authenticated users to execute arbitrary SQL commands by leveraging access to a privileged account.
References
Severity
6.5 Medium
Exploitation
2% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published4 Jun 2012
Updated3 Nov 2026
First seen11 Sep 2026
Sources
DEBIAN-CVE-2011-4460 · OSV
CVE-2011-4460 · NVD
Track software like this
Free during beta