MailWatch for MailScanner Authenticate Function SQL Injection Vulnerability

Bugtraq ID:	15278
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 02 2005 12:00AM
Updated:	Nov 02 2005 12:00AM
Credit:	Chris Graham is credited with the discovery of this vulnerability.
Vulnerable:	MailWatch for MailScanner MailWatch for MailScanner 1.0.2
Not Vulnerable:	MailWatch for MailScanner MailWatch for MailScanner 1.0.3

MailWatch for MailScanner Authenticate Function SQL Injection Vulnerability

MailWatch for MailScanner is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

MailWatch for MailScanner Authenticate Function SQL Injection Vulnerability

No exploit is required.

MailWatch for MailScanner Authenticate Function SQL Injection Vulnerability

Solution:
The vendor has released version 1.0.3 to address this issue.


MailWatch for MailScanner MailWatch for MailScanner 1.0.2

• Mailwatch for Mailscanner mailwatch-1.0.3.tar.gz
  http://prdownloads.sourceforge.net/mailwatch/mailwatch-1.0.3.tar.gz

MailWatch for MailScanner Authenticate Function SQL Injection Vulnerability

References:

• MailWatch for MailScanner Home Page (MailWatch for MailScanner)