Request Tracker SQL Injection Vulnerability in JSON Search

A SQL injection vulnerability has been identified in Request Tracker (RT) versions 5.0.0 prior to 5.0.10 and 6.0.0 prior to 6.0.3. This vulnerability allows authenticated users to manipulate input that is directly included in database queries without adequate validation. As a result, there is a potential risk of unauthorized data access or modification within the RT database.

Impact

Exploitation of this vulnerability allows for SQL injection, where an authenticated user can interfere with database queries. This could lead to unauthorized data access or manipulation within the RT database.

Remediation

Users can upgrade to RT versions 5.0.10 or 6.0.3. For those unable to upgrade immediately, it is recommended to restrict RT account access to trusted users.