CVE-2014-1471

SQL injection vulnerability in the StateGetStatesByType function in Kernel/System/State.pm in Open Ticket Request System (OTRS) 3.1.x before 3.1.19, 3.2.x before 3.2.14, and 3.3.x before 3.3.4 allows remote attackers to execute arbitrary SQL commands via vectors related to a ticket search URL.

• CWE-89

• http://osvdb.org/102661
• http://secunia.com/advisories/56644Vendor Advisory
• http://secunia.com/advisories/56655Vendor Advisory
• http://www.debian.org/security/2014/dsa-2867
• http://www.openwall.com/lists/oss-security/2014/01/29/15
• http://www.securityfocus.com/bid/65241
• https://github.com/OTRS/otrs/commit/0680603a07b8dc37c2ddca6ff14e0236babefc82Patch
• https://github.com/OTRS/otrs/commit/2997b36a7c84e933c4b025930cabe93efc4d261dPatch
• https://github.com/OTRS/otrs/commit/c4ec9205bde9c49770ddad94c1a980c006164949Patch
• https://www.otrs.com/release-notes-otrs-help-desk-3-3-4
• https://www.otrs.com/security-advisory-2014-02-sql-injection-issuePatch, Vendor Advisory
• http://osvdb.org/102661
• http://secunia.com/advisories/56644Vendor Advisory
• http://secunia.com/advisories/56655Vendor Advisory
• http://www.debian.org/security/2014/dsa-2867
• http://www.openwall.com/lists/oss-security/2014/01/29/15
• http://www.securityfocus.com/bid/65241
• https://github.com/OTRS/otrs/commit/0680603a07b8dc37c2ddca6ff14e0236babefc82Patch
• https://github.com/OTRS/otrs/commit/2997b36a7c84e933c4b025930cabe93efc4d261dPatch
• https://github.com/OTRS/otrs/commit/c4ec9205bde9c49770ddad94c1a980c006164949Patch
• https://www.otrs.com/release-notes-otrs-help-desk-3-3-4
• https://www.otrs.com/security-advisory-2014-02-sql-injection-issuePatch, Vendor Advisory

Published

Feb 4, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-1458Cross-site scripting (XSS) vulnerability in the web administ…
• CVE-2014-1459SQL injection vulnerability in dg-admin/index.php in doorGet…
• CVE-2014-1466SQL injection vulnerability in CSP MySQL User Manager 2.3 al…
• CVE-2014-1467BlackBerry Enterprise Service 10 before 10.2.1, Universal De…
• CVE-2014-1469BlackBerry Enterprise Server 5.x before 5.0.4 MR7 and Enterp…
• CVE-2014-1470Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2014-1472Multiple cross-site scripting (XSS) vulnerabilities in the E…
• CVE-2014-1473Multiple cross-site request forgery (CSRF) vulnerabilities i…
• CVE-2014-1474Algorithmic complexity vulnerability in Email::Address::List…
• CVE-2014-1475The OpenID module in Drupal 6.x before 6.30 and 7.x before 7…
• CVE-2014-1476The Taxonomy module in Drupal 7.x before 7.26, when upgraded…
• CVE-2014-1477Multiple unspecified vulnerabilities in the browser engine i…9.8