DMXReady Site Chassis Manager Cross-Site Scripting And SQL Injection Vulnerabilities
BID:11434
Info
DMXReady Site Chassis Manager Cross-Site Scripting And SQL Injection Vulnerabilities
| Bugtraq ID: | 11434 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 15 2004 12:00AM |
| Updated: | Oct 15 2004 12:00AM |
| Credit: | Positive Technologies disclosed these vulnerabilities. |
| Vulnerable: |
DMXReady Site Chassis Manager 0 |
| Not Vulnerable: | |
Discussion
DMXReady Site Chassis Manager Cross-Site Scripting And SQL Injection Vulnerabilities
It is reported that DMXReady Site Chassis Manager is susceptible to two remotely exploitable input validation vulnerabilities. These vulnerabilities are due to a failure of the application to properly sanitize user-supplied data.
The first issue is an unspecified cross-site scripting vulnerability. This issue could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.
The second issue is an unspecified SQL injection vulnerability. It may be possible for a remote user to inject arbitrary SQL queries into the underlying database used by the application. This could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks.
Successful exploitation could result in compromise of the application, disclosure or modification of data or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
It is reported that DMXReady Site Chassis Manager is susceptible to two remotely exploitable input validation vulnerabilities. These vulnerabilities are due to a failure of the application to properly sanitize user-supplied data.
The first issue is an unspecified cross-site scripting vulnerability. This issue could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.
The second issue is an unspecified SQL injection vulnerability. It may be possible for a remote user to inject arbitrary SQL queries into the underlying database used by the application. This could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks.
Successful exploitation could result in compromise of the application, disclosure or modification of data or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
Exploit / POC
DMXReady Site Chassis Manager Cross-Site Scripting And SQL Injection Vulnerabilities
An exploit is not required.
An exploit is not required.
Solution / Fix
DMXReady Site Chassis Manager Cross-Site Scripting And SQL Injection Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
DMXReady Site Chassis Manager Cross-Site Scripting And SQL Injection Vulnerabilities
References:
References:
- Advisories (MaxPatrol)
- DMXReady Homepage (DMXReady)