Title: ClientExec Plugin / Snapin System Unspecified SQL Injection
Nov 27, 2013
Nov 20, 2013
ClientExec contains a flaw in the plugin / snapin system that may allow an attacker to carry out an SQL injection attack. The issue is due to the program not properly sanitizing user-supplied input before using it in SQL queries. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.
Remote / Network Access
Loss of Integrity
It has been reported that this issue has been fixed. Upgrade to version 4.6.8, or higher, to address this vulnerability.