CWE Code: 89
Vulnerability Type: sql_injection
CVSS Score: 6.5
CWE Name:  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Summary: sql injection vulnerability in ibm maximo asset management 7.x before 7.1.1.7 lafix.20140319-0837, 7.1.1.11 before ifix.20140323-0749, 7.1.1.12 before ifix.20140321-1336, 7.5.x before 7.5.0.3 ifix027, 7.5.0.4 before ifix011, and 7.5.0.5 before ifix006; smartcloud control desk 7.x before 7.5.0.3 and 7.5.1.x before 7.5.1.2; and tivoli it asset management for it, tivoli service request manager, maximo service desk, and change and configuration management database (ccmdb) 7.x before 7.1.1.7 lafix.20140319-0837, 7.1.1.11 before ifix.20140207-1801, and 7.1.1.12 before ifix.20140218-1510 allows remote authenticated users to execute arbitrary sql commands via a birt report with a where clause in plain text.
Access Authentication: SINGLE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2014-05-26
Last Modified Date: 2017-08-29