BID:14437

MySQL Eventum Multiple SQL Injection Vulnerabilities

Info

MySQL Eventum Multiple SQL Injection Vulnerabilities

Bugtraq ID:	14437
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 01 2005 12:00AM
Updated:	Aug 01 2005 12:00AM
Credit:	James Bercegay of the GulfTech Security Research Team is credited with the discovery of these vulnerabilities.
Vulnerable:	MySQL AB Eventum 1.5.5 MySQL AB Eventum 1.5.4 MySQL AB Eventum 1.4 MySQL AB Eventum 1.3.1 MySQL AB Eventum 1.3 MySQL AB Eventum 1.2.2 MySQL AB Eventum 1.2.1 MySQL AB Eventum 1.2 MySQL AB Eventum 1.1

Not Vulnerable:	MySQL AB Eventum 1.6

Discussion

MySQL Eventum Multiple SQL Injection Vulnerabilities

MySQL Eventum is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Exploit / POC

MySQL Eventum Multiple SQL Injection Vulnerabilities

No exploit is required.

The following exploit is available:

/data/vulnerabilities/exploits/mysql_eventum-sql.pl

Solution / Fix

MySQL Eventum Multiple SQL Injection Vulnerabilities

Solution:
The vendor has addressed these issues in MySQL Eventum version 1.6.0:

MySQL AB Eventum 1.1