CVE-2013-7225 Fat Free CRM vulnerable to SQL Injection

What is CVE-2013-7225?

CVE-2013-7225 is a medium-severity SQL injection vulnerability in n/a, published on 2 Jan 2014. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Multiple SQL injection vulnerabilities in app/controllers/home_controller.rb in Fat Free CRM before 0.12.1 allow remote authenticated users to execute arbitrary SQL commands via (1) the homepage timeline feature or (2) the activity feature.

Weakness: CWE-89

Which versions are affected by CVE-2013-7225?

2 open source packages ship an affected version, including fat_free_crm. It affects 1 product.

Products include Fatfreecrm Fat Free Crm.

How do I fix CVE-2013-7225?

Upgrade fat_free_crm to 0.12.1 or later.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2013-7225 being exploited?

There is no known exploitation of CVE-2013-7225 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2015-1585 Fat Free CRM Cross-Site Request Forgery vulnerability Medium 6.8
• CVE-2013-7223 Fat Free CRM contains Cross-site Request Forgery vulnerablilities Medium 6.8
• CVE-2018-20975 Cross-site scripting in fat_free_crm Medium 6.1
• CVE-2019-10226 Cross-site scripting in n/a Medium 5.4
• CVE-2013-7222 Fat Free CRM has fixed token value Medium 5.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-9ggp-5rf4-x7q9.