SQL injection vulnerability in the get_employee function in classweekreport.inc in Achievo prior to 1.4.0 allows remote malicious users to execute arbitrary SQL commands via the userid parameter (aka user_id variable) to dispatch.php.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
achievo achievo 1.2.0 |
||
achievo achievo 1.0.1 |
||
achievo achievo 1.3.2 |
||
achievo achievo 1.3.1 |
||
achievo achievo 1.1.0 |
||
achievo achievo 0.7.1 |
||
achievo achievo 0.8.0 rc1 |
||
achievo achievo 0.8.0 |
||
achievo achievo 0.8.1 |
||
achievo achievo 1.0.0 |
||
achievo achievo 1.3.3 |
||
achievo achievo 1.2.1 |
||
achievo achievo 0.8.0 rc2 |
||
achievo achievo 1.0.2 |
||
achievo achievo 1.3.0 |
||
achievo achievo 0.7.2 |
||
achievo achievo 0.9.1 |
||
achievo achievo 1.0.3 |
||
achievo achievo 1.0.4 |
||
achievo achievo |
||
achievo achievo 0.7.3 |
||
achievo achievo 0.9.0 |
||
achievo achievo 0.7.0 |
Vulmon