CVE-2016-7803

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

SQL injection vulnerability in the Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to execute arbitrary SQL commands via "MultiReport" function.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Cybozu, Inc.	Cybozu Garoon	3.0.0 to 4.2.2

References

http://www.securityfocus.com/bid/94974Third Party Advisory, VDB Entry
https://jvn.jp/en/jp/JVN17980240/index.htmlThird Party Advisory, VDB Entry
https://support.cybozu.com/ja-jp/article/9447Vendor Advisory
http://www.securityfocus.com/bid/94974Third Party Advisory, VDB Entry
https://jvn.jp/en/jp/JVN17980240/index.htmlThird Party Advisory, VDB Entry
https://support.cybozu.com/ja-jp/article/9447Vendor Advisory

Timeline

Published: Jun 9, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-78047.8Untrusted search path vulnerability in 7 Zip for Windows 16.02 and earlier allows remote attackers to gain privileges via a Trojan horse DLL CVE-2016-78055.9The mobiGate App for Android version 2.2.1.2 and earlier and mobiGate App for iOS version 2.2.4.1 and earlier do not verify X.509 certificat CVE-2016-78069.8I-O DATA DEVICE WFS-SR01 firmware version 1.10 and earlier allow remote attackers to execute arbitrary OS commands via unspecified vectors.CVE-2016-78077.5I-O DATA DEVICE WFS-SR01 firmware version 1.10 and earlier allow remote attackers to bypass access restriction to access data on storage dev CVE-2016-78086.1Cross-site scripting vulnerability in Corega CG-WLBARGMH and CG-WLBARGNL allows remote attackers to inject arbitrary web script or HTML via CVE-2016-78098.8Cross-site request forgery (CSRF) vulnerability in Corega CG-WLR300NX firmware Ver. 1.20 and earlier allows remote attackers to hijack the a CVE-2016-78104.8Cross-site scripting vulnerability in Corega CG-WLR300NX firmware Ver. 1.20 and earlier allows attacker with administrator rights to inject CVE-2016-78118.8Corega CG-WLR300NX firmware Ver. 1.20 and earlier allows an attacker on the same network segment to bypass access restriction to perform arb CVE-2016-78123.1The Bank of Tokyo-Mitsubishi UFJ, Ltd. App for Android ver5.3.1, ver5.2.2 and earlier allow a man-in-the-middle attacker to downgrade the co CVE-2016-78136.1Cross-site scripting vulnerability in DERAEMON-CMS version 0.8.9 and earlier allows remote attackers to inject arbitrary web script or HTML CVE-2016-78147.5I-O DATA DEVICE TS-WRLP firmware version 1.00.01 and earlier and TS-WRLA firmware version 1.00.01 and earlier allow remote attackers to obta CVE-2016-78154.2Remote Service Manager 3.0.0 to 3.1.4 fails to verify client certificates, which may allow remote attackers to gain access to systems on the