On Fri, Dec 02, 2005 at 10:52:51AM +, Dominic Hargreaves wrote:
> Package: trac
> Version: 0.9-1
check incoming.debian.org 0.9.1-2 is already waiting and will be upgraded
tonight.
Cheers,
--
Jesus Climent info:www.pumuki.org
Unix SysAdm|Linux User #66350
Package: trac
Version: 0.9-1
Severity: grave
Tags: security
Justification: user security hole
As reported on Bugtraq[0]:
Malicious user can conduct SQL injection in ticket query module
because supplied 'group' URI data passed to the query script
is not properly sanitized.
PoC:
http://host/trac/
2 matches
Mail list logo