CVE-2016-5843

CriticalCVSS 9.4/10Last modified Jun 17, 2026

Description

Multiple SQL injection vulnerabilities in the FAQ package 2.x before 2.3.6, 4.x before 4.0.5, and 5.x before 5.0.5 in Open Ticket Request System (OTRS) allow remote attackers to execute arbitrary SQL commands via crafted search parameters.

Metrics

CVSS 3.0 9.4/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/93019
https://github.com/OTRS/FAQ/commit/3700f75c67f6ed1d39bc213445c6d12a458e1af9Issue Tracking, Patch
https://github.com/OTRS/FAQ/commit/8c9d63bd0297adda760330805c31afc130861557Issue Tracking, Patch
https://github.com/OTRS/FAQ/commit/b805703e7b7725d1f3040bb626a4c4dd845ee9e3Issue Tracking, Patch
https://www.otrs.com/security-advisory-2016-01-security-update-otrs-faq-package/Vendor Advisory
http://www.securityfocus.com/bid/93019
https://github.com/OTRS/FAQ/commit/3700f75c67f6ed1d39bc213445c6d12a458e1af9Issue Tracking, Patch
https://github.com/OTRS/FAQ/commit/8c9d63bd0297adda760330805c31afc130861557Issue Tracking, Patch
https://github.com/OTRS/FAQ/commit/b805703e7b7725d1f3040bb626a4c4dd845ee9e3Issue Tracking, Patch
https://www.otrs.com/security-advisory-2016-01-security-update-otrs-faq-package/Vendor Advisory

Timeline

Published: Sep 17, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-58446.5Integer overflow in the ISO parser in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) via a CVE-2016-58455.5SAP SAPCAR does not check the return value of file operations when extracting files, which allows remote attackers to cause a denial of serv CVE-2016-58475.8SAP SAPCAR allows local users to change the permissions of arbitrary files and consequently gain privileges via a hard link attack on files CVE-2016-58486.7Siemens SICAM PAS before 8.07 does not properly restrict password data in the database, which makes it easier for local users to calculate p CVE-2016-58492.5Siemens SICAM PAS through 8.07 allows local users to obtain sensitive configuration information by leveraging database stoppage.CVE-2016-58505.4Cross-site scripting (XSS) vulnerability in the volume backup service module in Huawei Public Cloud Solution before 1.0.5 allows remote auth CVE-2016-58518.8python-docx before 0.8.6 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted document.CVE-2016-58527.8For the NVIDIA Quadro, NVS, and GeForce products, GFE GameStream and NVTray Plugin unquoted service path vulnerabilities are examples of the CVE-2016-58537.0In an audio driver in all Qualcomm products with Android releases from CAF using the Linux kernel, when a sanity check encounters a length v CVE-2016-58544.7In a driver in all Qualcomm products with Android for MSM, Firefox OS for MSM, or QRD Android, kernel heap memory can be exposed to userspac CVE-2016-58554.7In a driver in all Qualcomm products with Android for MSM, Firefox OS for MSM, or QRD Android, a user-supplied buffer is casted to a structu CVE-2016-58567.0Drivers/soc/qcom/spcom.c in the Qualcomm SPCom driver in the Android kernel 2017-03-05 allows local users to gain privileges, a different vu