Chimera Web Portal Multiple Input Validation Vulnerabilities

Bugtraq ID:	16113
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 01 2006 12:00AM
Updated:	Jan 01 2006 12:00AM
Credit:	Discovery is credited to Aliaksandr Hartsuyeu.
Vulnerable:	Chimera Web Portal Chimera Web Portal 0.2
Not Vulnerable:

Chimera Web Portal Multiple Input Validation Vulnerabilities

Chimera Web Portal is prone to multiple input validation vulnerabilities. The issues include cross-site scripting and SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

Successful exploitation of these vulnerabilities could result in a compromise of the application, disclosure or modification of data, the theft of cookie-based authentication credentials. They may also permit an attacker to exploit vulnerabilities in the underlying database implementation as well as other attacks.

Chimera Web Portal Multiple Input Validation Vulnerabilities

The following examples were provided:

Cross-site Scripting -

http://www.example.com/chimera/modules.php?name=guestbook&file=index
comment_poster=XSS
comment_poster_email=XSS
comment_poster_homepage=XSS
comment_text=XSS

SQL Injection -

http://www.example.com/chimera/linkcategory.php?id=9999'%20union%20select%20admin_password%20from%20admin/*

Chimera Web Portal Multiple Input Validation Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Chimera Web Portal Multiple Input Validation Vulnerabilities

References:

• Chimera Web Portal Homepage (Chimera Web Portal)
  
• Chimera Web Portal System Multiple Vulnerabilities (eVuln)