Mediabox404 Login_Admin_Mediabox404.PHP SQL Injection Vulnerability
BID:14593
Info
Mediabox404 Login_Admin_Mediabox404.PHP SQL Injection Vulnerability
| Bugtraq ID: | 14593 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 17 2005 12:00AM |
| Updated: | Aug 17 2005 12:00AM |
| Credit: | Cedric Tissieres is credited with the discovery of this vulnerability. |
| Vulnerable: |
mediabox404 mediabox404 1.2 mediabox404 mediabox404 1.1 |
| Not Vulnerable: | |
Discussion
Mediabox404 Login_Admin_Mediabox404.PHP SQL Injection Vulnerability
mediabox404 is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. Reports indicate an attacker can exploit this vulnerability to bypass authentication and gain administrative access to the affected application.
mediabox404 is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. Reports indicate an attacker can exploit this vulnerability to bypass authentication and gain administrative access to the affected application.
Exploit / POC
Mediabox404 Login_Admin_Mediabox404.PHP SQL Injection Vulnerability
No exploit is required.
No exploit is required.
Solution / Fix
Mediabox404 Login_Admin_Mediabox404.PHP SQL Injection Vulnerability
Solution:
The vendor has addressed this issue in the latest CVS version.
Solution:
The vendor has addressed this issue in the latest CVS version.
References
Mediabox404 Login_Admin_Mediabox404.PHP SQL Injection Vulnerability
References:
References:
- mediabox404 Web Site (mediabox404)
- SQL injection in mediabox404 v1.2 (Cedric Tissieres)