CVE-2013-7225

Multiple SQL injection vulnerabilities in app/controllers/home_controller.rb in Fat Free CRM before 0.12.1 allow remote authenticated users to execute arbitrary SQL commands via (1) the homepage timeline feature or (2) the activity feature.

• CWE-89

• http://openwall.com/lists/oss-security/2013/12/28/2
• http://seclists.org/fulldisclosure/2013/Dec/199
• http://www.phenoelit.org/stuff/ffcrm.txtExploit
• https://github.com/fatfreecrm/fat_free_crm/commit/078035f1ef73ed85285ac9d128c3c5f670cef066Exploit, Patch
• https://github.com/fatfreecrm/fat_free_crm/commit/d4b2de81a4d8c1b201482edcb2488ed9280a65fdExploit, Patch
• https://github.com/fatfreecrm/fat_free_crm/issues/300
• https://github.com/fatfreecrm/fat_free_crm/wiki/Fixing-security-vulnerabilities-%2827th-Dec-2013%29Vendor Advisory
• http://openwall.com/lists/oss-security/2013/12/28/2
• http://seclists.org/fulldisclosure/2013/Dec/199
• http://www.phenoelit.org/stuff/ffcrm.txtExploit
• https://github.com/fatfreecrm/fat_free_crm/commit/078035f1ef73ed85285ac9d128c3c5f670cef066Exploit, Patch
• https://github.com/fatfreecrm/fat_free_crm/commit/d4b2de81a4d8c1b201482edcb2488ed9280a65fdExploit, Patch
• https://github.com/fatfreecrm/fat_free_crm/issues/300
• https://github.com/fatfreecrm/fat_free_crm/wiki/Fixing-security-vulnerabilities-%2827th-Dec-2013%29Vendor Advisory

Published

Jan 2, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-7219SQL injection vulnerability in vote.php in the 2Glux Sexy Po…
• CVE-2013-7220js/ui/screenShield.js in GNOME Shell (aka gnome-shell) befor…
• CVE-2013-7221The automatic screen lock functionality in GNOME Shell (aka …
• CVE-2013-7222config/initializers/secret_token.rb in Fat Free CRM before 0…
• CVE-2013-7223Multiple cross-site request forgery (CSRF) vulnerabilities i…
• CVE-2013-7224Fat Free CRM before 0.12.1 does not restrict JSON serializat…
• CVE-2013-7226Integer overflow in the gdImageCrop function in ext/gd/gd.c …
• CVE-2013-7231Cross-site scripting (XSS) vulnerability in the Mobile Conte…
• CVE-2013-7232SQL injection vulnerability in ESRI ArcGIS for Server throug…
• CVE-2013-7233Cross-site request forgery (CSRF) vulnerability in the retro…
• CVE-2013-7234Simple Machines Forum (SMF) before 1.1.19 and 2.x before 2.0…
• CVE-2013-7235Simple Machines Forum (SMF) before 1.1.19 and 2.x before 2.0…