CVE

CVE-2007-1882

Date: (C)2007-04-05   (M)2023-12-22

qcbin/servlet/tdservlet/TDAPI_GeneralWebTreatment in HP Mercury Quality Center 9.0 build 9.1.0.4352 allows remote authenticated users to execute arbitrary SQL commands via the RunQuery method.

CVSS Score and Metrics +CVSS Score and Metrics -

CVSS V2 Severity:
CVSS Score : 6.5
Exploit Score: 8.0
Impact Score: 6.4
CVSS V2 Metrics:
Access Vector: NETWORK
Access Complexity: LOW
Authentication: SINGLE
Confidentiality: PARTIAL
Integrity: PARTIAL
Availability: PARTIAL

Reference:

SECTRACK-1017842

http://lists.grok.org.uk/pipermail/full-disclosure/2007-April/053406.html

SECUNIA-24730

SREASON-2527

OSVDB-34630

ADV-2007-1246

hpmercuryquality-sql-command-execution(33385)