D3Jeeb Multiple SQL Injection Vulnerabilities

Bugtraq ID:	16853
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 25 2006 12:00AM
Updated:	Mar 02 2006 06:36AM
Credit:	Discovered by SAUDI.
Vulnerable:	D3Jeeb D3Jeeb Pro 3
Not Vulnerable:

D3Jeeb Multiple SQL Injection Vulnerabilities


D3Jeeb is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

D3Jeeb Multiple SQL Injection Vulnerabilities



These issues can be exploited through use of a web client.

The following proof of concept URI are available:

http://www.example.com/fastlinks.php?catid=[SQL]

http://www.example.com/catogary.php?catid=[SQL]

D3Jeeb Multiple SQL Injection Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]:[email protected].

D3Jeeb Multiple SQL Injection Vulnerabilities

References:

• D3Jeeb (D3Jeeb)
  
• 2 SQL Injection in d3jeeb ([email protected])