CVE:CVE-2015-7299
CNNVD:CNNVD-201510-365
K2 blackpearl、smartforms和K2 for SharePoint都是美国K2公司的产品。blackpearl是一套用于构建和运行业务流程的应用程序。smartforms是一款在线业务系统推送消息产品。K2 for SharePoint是一套用于在SharePoint 2013或Office上创建表单和工作流程的应用程序。
多款K2产品的Runtime/Runtime/AjaxCall.ashx文件中存在SQL注入漏洞。远程攻击者可借助‘xml’参数利用该漏洞执行任意SQL命令。以下产品及版本受到影响：K2 blackpearl，smartforms，K2 for SharePoint 4.6.7版本。
solution:Upgrade nintex k2_blackpearl to a higher version than 4.6.7,and avoid the version 4.6.7; Upgrade nintex k2_for_sharepoint to a higher version than 4.6.7,and avoid the version 4.6.7; Upgrade nintex k2_smartforms to a higher version than 4.6.7,and avoid the version 4.6.7