GHSA-xmq8-c3h6-wf48
GitHub Security Advisory
⚠ Unreviewed
MODERATE
Has CVE
Advisory Details
This vulnerability allows remote attackers to disclose sensitive information on affected installations of BMC Track-It! 20.21.02.109. Authentication is required to exploit this vulnerability. The specific flaw exists within the GetPopupSubQueryDetails endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-16690.
Related CVEs
Key Information
5.0
/10
Dataset
Last updated: September 22, 2025 6:29 AM
Data from GitHub Advisory Database. This information is provided for research and educational purposes.