WebSoft HelpDesk PRO SQL Injection Vulnerability
BID:10613
Info
WebSoft HelpDesk PRO SQL Injection Vulnerability
| Bugtraq ID: | 10613 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 26 2004 12:00AM |
| Updated: | Jun 26 2004 12:00AM |
| Credit: | Discovery of this issue is credited to D'Amato Luigi. |
| Vulnerable: |
WebSoft HelpDesk PRO 2.0 |
| Not Vulnerable: | |
Discussion
WebSoft HelpDesk PRO SQL Injection Vulnerability
Reportedly WebSoft HelpDesk PRO is affected by an SQL injection vulnerability. This issue is due to a failure of the application to properly sanitize user supplied URI input.
It is likely that this issue is related to the issue discussed in the vulnerability WebSoft Infinity WEB SQL Injection Vulnerability (BID 10614). This BID will be updated when information becomes available.
An attacker might leverage this issue to inject malicious SQL queries or alter existing ones. This would allow the attacker to manipulate database queries to bypass authentication mechanisms; other attack might also be possible.
Reportedly WebSoft HelpDesk PRO is affected by an SQL injection vulnerability. This issue is due to a failure of the application to properly sanitize user supplied URI input.
It is likely that this issue is related to the issue discussed in the vulnerability WebSoft Infinity WEB SQL Injection Vulnerability (BID 10614). This BID will be updated when information becomes available.
An attacker might leverage this issue to inject malicious SQL queries or alter existing ones. This would allow the attacker to manipulate database queries to bypass authentication mechanisms; other attack might also be possible.
Exploit / POC
WebSoft HelpDesk PRO SQL Injection Vulnerability
No exploit is required to leverage this issue.
No exploit is required to leverage this issue.
Solution / Fix
WebSoft HelpDesk PRO SQL Injection Vulnerability
Solution:
It has been reported that the vendor has released a patch dealing with this issue, although this has not been confirmed. Please see the referenced vendor web page and contact the vendor for more information.
Solution:
It has been reported that the vendor has released a patch dealing with this issue, although this has not been confirmed. Please see the referenced vendor web page and contact the vendor for more information.