https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 22 Oct 2026 19:58:46 +0000 https://cve.radiocsirt.org/vuln/cnvd-2017-01490 cnvd-2017-01490 https://cve.radiocsirt.org/vuln/cnvd-2017-01490 https://cve.radiocsirt.org/vuln/euvd-2026-73181 EUVD-2026-73181 https://cve.radiocsirt.org/vuln/euvd-2026-73181 https://cve.radiocsirt.org/vuln/fkie_cve-2017-5218 <p>A SQL Injection issue was discovered in SageCRM 7.x before 7.3 SP3. The AP_DocumentUI.asp web resource includes Utilityfuncs.js when the file is opened or viewed. This file crafts a SQL statement to identify the database that is to be in use with the current user&#39;s session. The database variable can be populated from the URL, and when supplied non-expected characters, can be manipulated to obtain access to the underlying database. The /CRM/CustomPages/ACCPAC/AP_DocumentUI.asp?SID=&lt;VALID-SID&gt;&amp;database=1&#39;;WAITFOR DELAY &#39;0:0:5&#39;-- URI is a Proof of Concept.</p> <p>A SQL Injection issue was discovered in SageCRM 7.x before 7.3 SP3. The AP_DocumentUI.asp web resource includes Utilityfuncs.js when the file is opened or viewed. This file crafts a SQL statement to identify the database that is to be in use with the current user&#39;s session. The database variable can be populated from the URL, and when supplied non-expected characters, can be manipulated to obtain access to the underlying database. The /CRM/CustomPages/ACCPAC/AP_DocumentUI.asp?SID=&lt;VALID-SID&gt;&amp;database=1&#39;;WAITFOR DELAY &#39;0:0:5&#39;-- URI is a Proof of Concept.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2017-5218 https://cve.radiocsirt.org/vuln/ghsa-v4x7-98xc-8fp6 <p>A SQL Injection issue was discovered in SageCRM 7.x before 7.3 SP3. The AP_DocumentUI.asp web resource includes Utilityfuncs.js when the file is opened or viewed. This file crafts a SQL statement to identify the database that is to be in use with the current user&#39;s session. The database variable can be populated from the URL, and when supplied non-expected characters, can be manipulated to obtain access to the underlying database. The /CRM/CustomPages/ACCPAC/AP_DocumentUI.asp?SID=&lt;VALID-SID&gt;&amp;database=1&#39;;WAITFOR DELAY &#39;0:0:5&#39;-- URI is a Proof of Concept.</p> <p>A SQL Injection issue was discovered in SageCRM 7.x before 7.3 SP3. The AP_DocumentUI.asp web resource includes Utilityfuncs.js when the file is opened or viewed. This file crafts a SQL statement to identify the database that is to be in use with the current user&#39;s session. The database variable can be populated from the URL, and when supplied non-expected characters, can be manipulated to obtain access to the underlying database. The /CRM/CustomPages/ACCPAC/AP_DocumentUI.asp?SID=&lt;VALID-SID&gt;&amp;database=1&#39;;WAITFOR DELAY &#39;0:0:5&#39;-- URI is a Proof of Concept.</p> https://cve.radiocsirt.org/vuln/ghsa-v4x7-98xc-8fp6 https://cve.radiocsirt.org/vuln/gsd-2017-5218 gsd-2017-5218 https://cve.radiocsirt.org/vuln/gsd-2017-5218