IWebNegar Multiple SQL Injection Vulnerabilities
BID:11946
Info
IWebNegar Multiple SQL Injection Vulnerabilities
| Bugtraq ID: | 11946 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 15 2004 12:00AM |
| Updated: | Dec 15 2004 12:00AM |
| Credit: | Discovery of these vulnerabilities is credited to shervin khaleghjou <[email protected]>. |
| Vulnerable: |
iWebNegar iWebNegar |
| Not Vulnerable: | |
Discussion
IWebNegar Multiple SQL Injection Vulnerabilities
iWebNegar is reported prone to multiple SQL injection vulnerabilities, these issues exist due to a lack of sufficient boundary checks performed on user-supplied URI parameter data.
These issues could theoretically be exploited to compromise the software by performing unauthorized actions on the database, such as modifying or viewing data. SQL injection attacks may also be used to exploit latent vulnerabilities in the underlying database. This may depend on the nature of the query being manipulated as well as the capabilities of the database implementation.
iWebNegar is reported prone to multiple SQL injection vulnerabilities, these issues exist due to a lack of sufficient boundary checks performed on user-supplied URI parameter data.
These issues could theoretically be exploited to compromise the software by performing unauthorized actions on the database, such as modifying or viewing data. SQL injection attacks may also be used to exploit latent vulnerabilities in the underlying database. This may depend on the nature of the query being manipulated as well as the capabilities of the database implementation.
Exploit / POC
IWebNegar Multiple SQL Injection Vulnerabilities
No exploit is required, the following example is available:
http://www.example.com/weblog/index.php?string=[sql injection code]
No exploit is required, the following example is available:
http://www.example.com/weblog/index.php?string=[sql injection code]
Solution / Fix
IWebNegar Multiple SQL Injection Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
IWebNegar Multiple SQL Injection Vulnerabilities
References:
References:
- iWebNegar Homepage (iWebNegar)
- iwebnegar is vulnerable to all kind of sql injections (shervin khaleghjou