CVE-2011-5072: Sitracker Support Incident Tracker

High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days.

Multiple SQL injection vulnerabilities in Support Incident Tracker (aka SiT!) before 3.65 allow remote attackers to execute arbitrary SQL commands via the (1) start parameter to portal/kb.php; (2) contractid parameter to contract_add_service.php; (3) id parameter to edit_escalation_path.php; (4) unlock, (5) lock, or (6) selected parameter to holding_queue.php; inc parameter in a report action to (7) report_customers.php or (8) report_incidents_by_site.php; (9) start parameter to search.php; or (10) sites parameter to transactions.php.

Affected products

• Sitracker Support Incident Tracker: up to and including 3.64; version 3.6 only; version 3.21 only; version 3.22 only; version 3.22pl1 only; version 3.23 only; …

Published 2012-01-29. Last modified 2026-06-16.