The following files still have the same SQL injection vulnerability, carried over from vTiger 4.2.3. Although these aren't a problem with magic_quotes_gpc turned ON, it still needs to be fixed. It has been fixed in other modules by putting the PearDatabase::quote() function around any variable that needs to be placed in an SQL statement.
<br><br>Affected files:<br>modules\Faq\ListView.php<br>modules\HelpDesk\ListView.php<br>modules\Invoice\Popup.php<br>modules\Leads\ListView.php<br>modules\Leads\Popup.php<br>modules\Products\Popup.php<br clear="all"><br>Implementing this would reduce the SQL injection vulnerability for vTiger
4.2.x<br><br>-- <br>Mike O'Loan<br>Chief Technical Officer<br>Sauce Software Pty Ltd<br> <br><br> <a href="http://saucesoft.com" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">http://saucesoft.com
</a><br> Phone: +61 1300 559 165<br> Fax: +61 7 3009 0442
<br> Email: <a href="mailto:mike.oloan@saucesoft.com" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">mike.oloan@saucesoft.com</a>