CVE-2013-3525: SQL injection vulnerability in Approvals/ in Request Tracker (RT) 4.0.10 and earlier allows remote attacker...

Security readout for executives and security teams

This CVE alleges SQL injection in Request Tracker Approvals for RT 4.0.10 and earlier via the ShowPending parameter. The key business issue is uncertainty: the vendor publicly disputed the report, said it could not reproduce it, and said the reporter retracted it. Potential exposure is limited to organizations running Request Tracker 4.0.10 or earlier with the Approvals functionality reachable. The bundle does not prove exploitability or identify later affected versions. Handle as a verification item, not a confirmed emergency. If legacy RT is still active, assign ownership to validate exposure and vendor guidance promptly. Mitigation focus: Inventory Request Tracker deployments and confirm whether any are version 4.0.10 or earlier.; Check Best Practical vendor guidance for current security recommendations and supported RT versions.; Do not rely on this CVE alone to justify emergency changes without local exposure evidence..

Prepared

Jun 14, 2026, 22:07 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.