CFMagic Multiple Products Input Validation Vulnerabilities
BID:15774
Info
CFMagic Multiple Products Input Validation Vulnerabilities
| Bugtraq ID: | 15774 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 08 2005 12:00AM |
| Updated: | Dec 08 2005 12:00AM |
| Credit: | r0t is credited with the discovery of these vulnerabilities. |
| Vulnerable: |
CFMagic Magic List Professional 2.5 CFMagic Magic Forum Personal 2.5 CFMagic Magic Book Professional 2.0 |
| Not Vulnerable: | |
Discussion
CFMagic Multiple Products Input Validation Vulnerabilities
CFMagic Products are prone to multiple input validation vulnerabilities. These are due to a lack of proper sanitization of user-supplied input.
These vulnerabilities allow an attacker to inject malicious SQL code into database queries, and conduct cross-site scripting attacks.
Magic Book Professional version 2.0 and prior, Magic List Professional version 2.5 and prior, and Magic Forum Personal versions 2.5 and prior are vulnerable.
Other versions of these applications may also be affected.
CFMagic Products are prone to multiple input validation vulnerabilities. These are due to a lack of proper sanitization of user-supplied input.
These vulnerabilities allow an attacker to inject malicious SQL code into database queries, and conduct cross-site scripting attacks.
Magic Book Professional version 2.0 and prior, Magic List Professional version 2.5 and prior, and Magic Forum Personal versions 2.5 and prior are vulnerable.
Other versions of these applications may also be affected.
Exploit / POC
CFMagic Multiple Products Input Validation Vulnerabilities
No exploit is required.
Example URI have been provided:
http://www.example.com/view_archive.cfm?ListID=[SQL]
http://www.example.com/view_forum.cfm?ForumID=1[SQL]
http://www.example.com/view_thread.cfm?ForumID=1[SQL]
http://www.example.com/view_thread.cfm?ForumID=1&ThreadID=1&Thread=1[SQL]
http://www.example.com/view_thread.cfm?ForumID=1&ThreadID=1[SQL]
http://www.example.com/book.cfm?StartRow=%22%3E%3Cscript%3Ealert('r0t')%3C/script%3E
No exploit is required.
Example URI have been provided:
http://www.example.com/view_archive.cfm?ListID=[SQL]
http://www.example.com/view_forum.cfm?ForumID=1[SQL]
http://www.example.com/view_thread.cfm?ForumID=1[SQL]
http://www.example.com/view_thread.cfm?ForumID=1&ThreadID=1&Thread=1[SQL]
http://www.example.com/view_thread.cfm?ForumID=1&ThreadID=1[SQL]
http://www.example.com/book.cfm?StartRow=%22%3E%3Cscript%3Ealert('r0t')%3C/script%3E
Solution / Fix
CFMagic Multiple Products Input Validation Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
CFMagic Multiple Products Input Validation Vulnerabilities
References:
References:
- Magic Book Professional Web Site (CFMagic)
- Magic Book v2.0 Professional Vuln. (r0t)
- Magic Forum Personal SQL&XSS vuln. (r0t)
- Magic Forum Personal Web Site (CFMagic)
- Magic List pro 2.5 SQL inj. vuln. (r0t)
- Magic List Professional Web Site (CFMagic)