WebSoft Infinity WEB SQL Injection Vulnerability
BID:10614
Info
WebSoft Infinity WEB SQL Injection Vulnerability
| Bugtraq ID: | 10614 |
| Class: | Input Validation Error |
| CVE: |
CVE-2004-0625 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 28 2004 12:00AM |
| Updated: | Jul 12 2009 05:16AM |
| Credit: | Discovery of this issue is credited to D'Amato Luigi. |
| Vulnerable: |
WebSoft Infinity WEB 1.0 |
| Not Vulnerable: | |
Discussion
WebSoft Infinity WEB SQL Injection Vulnerability
Reportedly WebSoft Infinity WEB is affected by an SQL injection vulnerability. This issue is due to a failure of the application to properly sanitize user supplied URI input.
It is likely that this issue is related to the issue discussed in the vulnerability WebSoft HelpDesk PRO SQL Injection Vulnerability (BID 10613). This BID will be updated when information becomes available.
An attacker might leverage this issue to inject malicious SQL queries or alter existing ones. This would allow the attacker to manipulate database queries to bypass authentication mechanisms; other attack might also be possible.
Reportedly WebSoft Infinity WEB is affected by an SQL injection vulnerability. This issue is due to a failure of the application to properly sanitize user supplied URI input.
It is likely that this issue is related to the issue discussed in the vulnerability WebSoft HelpDesk PRO SQL Injection Vulnerability (BID 10613). This BID will be updated when information becomes available.
An attacker might leverage this issue to inject malicious SQL queries or alter existing ones. This would allow the attacker to manipulate database queries to bypass authentication mechanisms; other attack might also be possible.
Exploit / POC
WebSoft Infinity WEB SQL Injection Vulnerability
No exploit is required to leverage this issue.
No exploit is required to leverage this issue.
Solution / Fix
WebSoft Infinity WEB SQL Injection Vulnerability
Solution:
It has been reported that the vendor has released a patch dealing with this issue, although this has not been confirmed. Please see the referenced vendor web page and contact the vendor for more information.
Solution:
It has been reported that the vendor has released a patch dealing with this issue, although this has not been confirmed. Please see the referenced vendor web page and contact the vendor for more information.