S9Y Serendipity Exit.PHP SQL injection Vulnerability

Bugtraq ID:	13161
Class:	Input Validation Error
CVE:	CVE-2005-1134
Remote:	Yes
Local:	No
Published:	Apr 13 2005 12:00AM
Updated:	Jul 12 2009 12:56PM
Credit:	Discovery of this issue is credited to kreon <[email protected]>.
Vulnerable:	S9Y Serendipity 0.8 -beta6 S9Y Serendipity 0.8 -beta5 S9Y Serendipity 0.7.1 S9Y Serendipity 0.7 beta3 S9Y Serendipity 0.7 beta1 S9Y Serendipity 0.7 -rc1 S9Y Serendipity 0.7 -beta4 S9Y Serendipity 0.7 -beta2 S9Y Serendipity 0.7 S9Y Serendipity 0.6 -rc2 S9Y Serendipity 0.6 -rc1 S9Y Serendipity 0.6 -pl3 S9Y Serendipity 0.6 -pl2 S9Y Serendipity 0.6 -pl1 S9Y Serendipity 0.6 S9Y Serendipity 0.5 -pl1 S9Y Serendipity 0.5 S9Y Serendipity 0.4 S9Y Serendipity 0.3
Not Vulnerable:	S9Y Serendipity 0.8 -beta6 Snapshot S9Y Serendipity 0.8 -beta6 S9Y Serendipity 0.7.1

S9Y Serendipity Exit.PHP SQL injection Vulnerability

Serendipity is affected by an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input to the 'exit.php' script before using it in an SQL query.

This vulnerability could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks.

S9Y Serendipity Exit.PHP SQL injection Vulnerability

The following exploit is available:

• /data/vulnerabilities/exploits/adz_serendipity.pl

S9Y Serendipity Exit.PHP SQL injection Vulnerability

Solution:
The vendor has stated this issue has been addressed in Serendipity version 0.7.1, however 0.8 versions of the software are vulnerable. The vendor suggests that all users running a 0.8 release of the software should upgrade to the latest beta release. Please see Serendipity News for further information.


S9Y Serendipity 0.3

• S9Y Serendipity 0.8-beta6 snapshot
  http://www.s9y.org/12.html

S9Y Serendipity 0.4

• S9Y Serendipity 0.8-beta6 snapshot
  http://www.s9y.org/12.html

S9Y Serendipity 0.5

• S9Y Serendipity 0.8-beta6 snapshot
  http://www.s9y.org/12.html

S9Y Serendipity 0.5 -pl1

• S9Y Serendipity 0.8-beta6 snapshot
  http://www.s9y.org/12.html

S9Y Serendipity 0.6

• S9Y Serendipity 0.8-beta6 snapshot
  http://www.s9y.org/12.html

S9Y Serendipity 0.6 -rc1

• S9Y Serendipity 0.8-beta6 snapshot
  http://www.s9y.org/12.html

S9Y Serendipity 0.6 -pl3

• S9Y Serendipity 0.8-beta6 snapshot
  http://www.s9y.org/12.html

S9Y Serendipity 0.6 -rc2

• S9Y Serendipity 0.8-beta6 snapshot
  http://www.s9y.org/12.html

S9Y Serendipity 0.6 -pl2

• S9Y Serendipity 0.8-beta6 snapshot
  http://www.s9y.org/12.html

S9Y Serendipity 0.6 -pl1

• S9Y Serendipity 0.8-beta6 snapshot
  http://www.s9y.org/12.html

S9Y Serendipity 0.7 -rc1

• S9Y Serendipity 0.8-beta6 snapshot
  http://www.s9y.org/12.html

S9Y Serendipity 0.7 beta1

• S9Y Serendipity 0.8-beta6 snapshot
  http://www.s9y.org/12.html

S9Y Serendipity 0.7 beta3

• S9Y Serendipity 0.8-beta6 snapshot
  http://www.s9y.org/12.html

S9Y Serendipity 0.7

• S9Y Serendipity 0.8-beta6 snapshot
  http://www.s9y.org/12.html

S9Y Serendipity 0.7 -beta4

• S9Y Serendipity 0.8-beta6 snapshot
  http://www.s9y.org/12.html

S9Y Serendipity 0.7 -beta2

• S9Y Serendipity 0.8-beta6 snapshot
  http://www.s9y.org/12.html

S9Y Serendipity 0.7.1

• S9Y Serendipity 0.8-beta6 snapshot
  http://www.s9y.org/12.html

S9Y Serendipity 0.8 -beta6

• S9Y Serendipity 0.8-beta6 snapshot
  http://www.s9y.org/12.html

S9Y Serendipity 0.8 -beta5

• S9Y Serendipity 0.8-beta6 snapshot
  http://www.s9y.org/12.html

S9Y Serendipity Exit.PHP SQL injection Vulnerability

References:

• Serendipity Homepage (S9Y)
  
• Serendipity News - Serendipity 0.7.1 Maintaineance Release (S9Y)
  
• serendipity SQL Injection vulnerability (kreon )