Vulnerability record · CVE-2011-5072 · published 29 January 2012

CVE-2011-5072: Sitracker support incident tracker sql injection vulnerability

Sitracker · Support Incident Tracker

Multiple SQL injection vulnerabilities in Support Incident Tracker (aka SiT!) before 3.65 allow remote attackers to execute arbitrary SQL commands via the (1) start parameter to portal/kb.php; (2) contractid parameter to contract_add_service.php; (3) id parameter to edit_escalation_path.php; (4) unlock, (5) lock, or (6) selected parameter to holding_queue.php; inc parameter in a report action to (7) report_customers.php or (8) report_incidents_by_site.php; (9) start parameter to search.php; or (10) sites parameter to transactions.php.

7.5 CVSS 2.0 High EPSS 1.0% · top 38.2% CWE-89 · SQL injection

7.5CVSS 2.0 base score

1.0%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

8References, 4 tagged exploit

16 Jun 2026Last modified by NVD

Description

AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Support Incident Tracker Sitracker

References

Link	Tags
http://secunia.com/advisories/46019	Vendor Advisory
http://sitracker.org/wiki/ReleaseNotes365
http://www.securityfocus.com/archive/1/519636	Exploit
https://www.htbridge.ch/advisory/multiple_vulnerabilities_in_sit_support_incident_tracker.html	Exploit
http://secunia.com/advisories/46019	Vendor Advisory
http://sitracker.org/wiki/ReleaseNotes365
http://www.securityfocus.com/archive/1/519636	Exploit
https://www.htbridge.ch/advisory/multiple_vulnerabilities_in_sit_support_incident_tracker.html	Exploit

Track CVE-2011-5072 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2007-5635Sitracker support incident tracker vulnerabilityMultiple unspecified vulnerabilities in Salford Software Support Incident Tracker (SiT!) before 3.30 have unknown impact and attack vectors.EPSS 1.4%23 Oct 2007 7.5CVE-2011-4337Sitracker support incident tracker code injection vulnerabilityStatic code injection vulnerability in translate.php in Support Incident Tracker (aka SiT!) 3.45 through 3.65 allows remote attackers to inject arbit…EPSS 2.4%29 Jan 2012 7.5CVE-2011-3831Sitracker support incident tracker sql injection vulnerabilitySQL injection vulnerability in incident_attachments.php in Support Incident Tracker (aka SiT!) 3.65 allows remote attackers to execute arbitrary SQL …EPSS 1.7%29 Jan 2012 7.5CVE-2011-5071Sitracker support incident tracker sql injection vulnerabilityMultiple SQL injection vulnerabilities in Support Incident Tracker (aka SiT!) before 3.64 allow remote attackers to execute arbitrary SQL commands vi…EPSS 1.0%29 Jan 2012 6.8CVE-2011-5074Sitracker support incident tracker cross-site request forgery vulnerabilityMultiple cross-site request forgery (CSRF) vulnerabilities in Support Incident Tracker (aka SiT!) before 3.65 allow remote attackers to hijack the au…EPSS 0.99%29 Jan 2012 6.8CVE-2011-5068Sitracker support incident tracker cross-site request forgery vulnerabilityMultiple cross-site request forgery (CSRF) vulnerabilities in Support Incident Tracker (aka SiT!) 3.65 allow remote attackers to hijack the authentic…EPSS 0.70%29 Jan 2012 6.8CVE-2010-1596Sitracker support incident tracker improper authentication vulnerabilitySupport Incident Tracker before 3.51, when using LDAP authentication with anonymous binds, allows remote attackers to bypass authentication via an em…EPSS 1.5%28 Apr 2010 6.5CVE-2011-3832Sitracker support incident tracker code injection vulnerabilityEval injection vulnerability in config.php in Support Incident Tracker (aka SiT!) 3.65 allows remote authenticated administrators to execute arbitrar…EPSS 1.3%29 Jan 2012

Source: NIST National Vulnerability Database (record CVE-2011-5072), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.