CVE-2013-3525

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2013-05-10 · updated 2026-06-16
Weakness: CWE-89

Description

SQL injection vulnerability in Approvals/ in Request Tracker (RT) 4.0.10 and earlier allows remote attackers to execute arbitrary SQL commands via the ShowPending parameter. NOTE: the vendor disputes this issue, stating "We were unable to replicate it, and the individual that reported it retracted their report," and "we had verified that the claimed exploit did not function according to the author's claims.

Affected products

Best Practical Request Tracker: through 4.0.9; 3.6.8, 3.6.10, 3.6.11, 3.8.3, 3.8.4, 3.8.7 (+17)

References

http://blog.bestpractical.com/2013/04/on-our-security-policies.html
http://cxsecurity.com/issue/WLB-2013040083
http://osvdb.org/92265
http://packetstormsecurity.com/files/121245/RT-Request-Tracker-4.0.10-SQL-Injection.html
http://www.securityfocus.com/bid/59022
https://exchange.xforce.ibmcloud.com/vulnerabilities/83375
http://blog.bestpractical.com/2013/04/on-our-security-policies.html
http://cxsecurity.com/issue/WLB-2013040083
http://osvdb.org/92265
http://packetstormsecurity.com/files/121245/RT-Request-Tracker-4.0.10-SQL-Injection.html
http://www.securityfocus.com/bid/59022
https://exchange.xforce.ibmcloud.com/vulnerabilities/83375

Get alerted when CVE-2013-3525 or the next vulnerability affects your stack