CVE-2013-3525

Published: May 10, 2013Modified: Apr 29, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

SQL injection vulnerability in Approvals/ in Request Tracker (RT) 4.0.10 and earlier allows remote attackers to execute arbitrary SQL commands via the ShowPending parameter. NOTE: the vendor disputes this issue, stating "We were unable to replicate it, and the individual that reported it retracted their report," and "we had verified that the claimed exploit did not function according to the author's claims.

Affected (24)

Products: Bestpractical: Request Tracker

Bestpractical

1 product

Request Tracker

Configuration A

24 vulnerable

Vulnerable Software	Affected Versions
Bestpractical Request Tracker	Up to 4.0.9
Bestpractical Request Tracker	Version 3.6.10
Bestpractical Request Tracker	Version 3.6.11
Bestpractical Request Tracker	Version 3.6.8
Bestpractical Request Tracker	Version 3.8.10
Bestpractical Request Tracker	Version 3.8.11
Bestpractical Request Tracker	Version 3.8.12
Bestpractical Request Tracker	Version 3.8.13
Bestpractical Request Tracker	Version 3.8.14
Bestpractical Request Tracker	Version 3.8.15
Bestpractical Request Tracker	Version 3.8.16
Bestpractical Request Tracker	Version 3.8.3
Bestpractical Request Tracker	Version 3.8.4
Bestpractical Request Tracker	Version 3.8.7
Bestpractical Request Tracker	Version 3.8.9
Bestpractical Request Tracker	Version 4.0.0
Bestpractical Request Tracker	Version 4.0.1
Bestpractical Request Tracker	Version 4.0.2
Bestpractical Request Tracker	Version 4.0.3
Bestpractical Request Tracker	Version 4.0.4
Bestpractical Request Tracker	Version 4.0.5
Bestpractical Request Tracker	Version 4.0.6
Bestpractical Request Tracker	Version 4.0.7
Bestpractical Request Tracker	Version 4.0.8