Oi! Email Marketing System Index.PHP SQL Injection Vulnerability
BID:16794
Info
Oi! Email Marketing System Index.PHP SQL Injection Vulnerability
| Bugtraq ID: | 16794 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 23 2006 12:00AM |
| Updated: | Feb 23 2006 12:00AM |
| Credit: | [email protected] is credited with the discovery of this vulnerability. |
| Vulnerable: |
Miro Software Solutions Pty Ltd Oi! Email Marketing 3.0 |
| Not Vulnerable: | |
Discussion
Oi! Email Marketing System Index.PHP SQL Injection Vulnerability
Oi! Email Marketing System is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.
Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. Exploitation may also cause a denial of service condition.
Oi! Email Marketing System is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.
Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. Exploitation may also cause a denial of service condition.
Exploit / POC
Oi! Email Marketing System Index.PHP SQL Injection Vulnerability
This issue can be exploited through a web client.
The following example is available:
go to http://www.example.com/oi/index.php
In this login page provide the following inputs:
Username : username' OR '
Password : ' OR '
This issue can be exploited through a web client.
The following example is available:
go to http://www.example.com/oi/index.php
In this login page provide the following inputs:
Username : username' OR '
Password : ' OR '
Solution / Fix
Oi! Email Marketing System Index.PHP SQL Injection Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]:[email protected] <mailto:[email protected]:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]:[email protected] <mailto:[email protected]:[email protected]>.
References
Oi! Email Marketing System Index.PHP SQL Injection Vulnerability
References:
References: