Alienvault Open Source SIEM (OSSIM) 3.1 - 'date_from' Multiple SQL Injections

Author: Yu-Chi Ding
type: webapps
platform: php
port: 
date_added: 2013-10-02 
date_updated: 2015-11-21 
verified: 1 
codes: CVE-2013-5967;OSVDB-98052 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/62790/info

Open Source SIEM (OSSIM) is prone to multiple SQL-injection vulnerabilities.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Open Source SIEM (OSSIM) 4.3.0 and prior are vulnerable.

http://www.example.com/RadarReport/radar-iso27001-potential.php?date_from=%Inject_Here%

http://www.example.com/RadarReport/radar-iso27001-A12IS_acquisition-pot.php?date_from=%Inject_Here%