Description

In webERP 4.15, the Import Bank Transactions function fails to sanitize the content of imported MT940 bank statement files, resulting in the execution of arbitrary SQL queries, aka SQL Injection.

Remediation

References

CVE-2019-7755

Related Vulnerabilities

WordPress Plugin WP Symposium Pro Social Network Cross-Site Scripting (16.01)

MySQL CVE-2019-2791 Vulnerability (CVE-2019-2791)

OpenSSL Other Vulnerability (CVE-2014-3505)

Apache Tomcat Improper Input Validation Vulnerability (CVE-2014-0033)

Oracle Database Server CVE-2006-1866 Vulnerability (CVE-2006-1866)

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities CWE-138 CVE-2019-7755