HP.Data.Protector.RequestCopy.SQL.Injection

Release Date Dec 13, 2011
Severity critical
Impact System Compromise: Remote attackers can gain control of vulnerable systems.
Description This indicates an attack attempt to exploit a SQL Injection vulnerability in HP Data Protector. The vulnerability is due to insufficient sanitizing of user supplied inputs in the application. As a result, a remote attacker can send a crafted query to execute SQL commands on a vulnerable server.
Affected Products HP Data Protector for Personal Computers 7.0 and earlier versions. HP Data Protector Notebook Extension 6.20 and earlier versions.
Recommended Actions Apply patch available from the website: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03058866&ac.admitted=1321021660321.876444892.199480143
Coverage IPS VCM
Common Vulnerabilities and Exposures (CVE) CVE-2011-3158

Fortinet