CWE Code: 89
Vulnerability Type: sql_injection
CVSS Score: 4.0
CWE Name:  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Summary: rockoa 1.8.7 allows remote attackers to obtain sensitive information because the webmain/webmainaction.php publictreestore method constructs a sql where clause unsafely by using the pidfields and idfields parameters, aka background sql injection.
Access Authentication: SINGLE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/NONE/NONE
Published Date: 2019-06-28
Last Modified Date: 2019-07-05