GHSA-r64j-5w3w-fp49

Source

https://github.com/advisories/GHSA-r64j-5w3w-fp49

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-r64j-5w3w-fp49/GHSA-r64j-5w3w-fp49.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-r64j-5w3w-fp49

Aliases

CVE-2015-7564

Published

2022-05-17T02:49:24Z

Modified

2025-04-22T18:12:16Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

TeamPass vulnerable to SQL Injection

Details

Multiple SQL injection vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in an action_on_quick_icon action to item.query.php or the (2) order or (3) direction parameter in an (a) connections_logs, (b) errors_logs or (c) access_logs action to view.query.php.

Database specific

{
    "cwe_ids": [
        "CWE-89"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-04-22T17:33:24Z",
    "nvd_published_at": "2017-04-12T22:59:00Z",
    "severity": "CRITICAL"
}

References

Affected packages

Packagist / nilsteampassnet/teampass

Package

Name: nilsteampassnet/teampass
Purl: pkg:composer/nilsteampassnet/teampass

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.1.25

Affected versions

2.*

2.1.21

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-r64j-5w3w-fp49/GHSA-r64j-5w3w-fp49.json"