CPG Dragonfly CMS SQL Injection Vulnerability
BID:16783
Info
CPG Dragonfly CMS SQL Injection Vulnerability
| Bugtraq ID: | 16783 |
| Class: | Input Validation Error |
| CVE: |
CVE-2006-0727 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 22 2006 12:00AM |
| Updated: | Feb 23 2006 10:12PM |
| Credit: | albanialove is credited with the discovery of this vulnerability. |
| Vulnerable: |
CPG Dragonfly Dragonfly CMS 9.0.6 .1 |
| Not Vulnerable: | |
Discussion
CPG Dragonfly CMS SQL Injection Vulnerability
Dragonfly is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.
Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
Dragonfly is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.
Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
Exploit / POC
CPG Dragonfly CMS SQL Injection Vulnerability
This issue can be exploited through a web client.
This issue can be exploited through a web client.
Solution / Fix
CPG Dragonfly CMS SQL Injection Vulnerability
Solution:
The vendor has addressed this issue in the latest CVS released. Contact the vendor for details on obtaining the appropriate fixes.
Solution:
The vendor has addressed this issue in the latest CVS released. Contact the vendor for details on obtaining the appropriate fixes.
References
CPG Dragonfly CMS SQL Injection Vulnerability
References:
References: