Analyst readout for executives and security teams
Plain-English summary
CVE-2013-5967 is a remote SQL injection issue in AlienVault OSSIM 4.3 and earlier. An attacker who can reach specific RadarReport pages could manipulate database queries through the date_from field, potentially affecting confidentiality and integrity of security monitoring data.
Executive priority
Treat this as a high-priority legacy exposure issue if OSSIM 4.3 or earlier is still in use. Security monitoring platforms hold sensitive operational data, so reachable vulnerable reporting pages should be isolated and remediated quickly.
Technical view
The CVE describes multiple SQL injection flaws in the date_from parameter across five RadarReport PHP files in AlienVault OSSIM 4.3 and earlier. The stated impact is remote execution of arbitrary SQL commands. The provided bundle contains no CVSS score, CWE mapping, patch version, or confirmed exploitation evidence.
Likely exposure
Exposure is most likely where AlienVault OSSIM 4.3 or earlier remains deployed and its web reporting interface is reachable by untrusted users or networks.
Exploitation context
The CVE is not listed as KEV in the provided bundle, and no cited source confirms active exploitation. Public references exist, but the supplied evidence does not include exploit status, exploitation maturity, or weaponized details.
Researcher notes
The strongest source detail is the CVE description itself. The bundle lacks CVSS, CWE, affected CPEs, patch information, and confirmed exploit activity. Validate against actual OSSIM version, route exposure, authentication boundaries, and vendor guidance before assigning final operational severity.
Mitigation direction
- Identify any AlienVault OSSIM instances and confirm whether versions are 4.3 or earlier.
- Check vendor guidance for supported upgrade or patch direction before production changes.
- Restrict OSSIM reporting interface access to trusted administrative networks.
- Review application database privileges and reduce excessive permissions where feasible.
- Monitor web logs for unusual access to the listed RadarReport PHP files.
Validation and detection
- Inventory internet-facing and internal OSSIM web interfaces.
- Confirm installed OSSIM versions against the affected range: 4.3 and earlier.
- Check whether RadarReport paths are reachable by unauthorized users.
- Review logs for suspicious requests involving date_from on named RadarReport files.
- Validate remediation with authorized exposure checks, not exploit payloads.
Public sources used
Based on public source material and reviewed before publication.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Database behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2013-5967 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- 62790CVE reference · vdb-entry, x_refsource_BID
- http://osvdb.org/ref/97/ossim-sql.txtCVE reference · x_refsource_MISC
- 98052CVE reference · vdb-entry, x_refsource_OSVDB
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.