Gregarius Multiple Input Validation Vulnerabilities

Bugtraq ID:	16939
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 03 2006 12:00AM
Updated:	Mar 08 2006 02:05PM
Credit:	[email protected] is credited with the discovery of these vulnerabilities.
Vulnerable:	Gregarius Gregarius 0.5.2
Not Vulnerable:

Gregarius Multiple Input Validation Vulnerabilities

Gregarius is prone to multiple input-validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

The application is prone to cross-site scripting and SQL-injection vulnerabilities.

Gregarius version 0.5.2 is vulnerable to these issues; other versions may also be affected.

Gregarius Multiple Input Validation Vulnerabilities

These issues could be exploited with a web client.

Gregarius Multiple Input Validation Vulnerabilities

Solution:
The vendor has committed fixes for these issues to their Subversion repository.

Note that numerous input-validation sanitization routines have been added in the Gregarius Subversion repository. These fixes imply that other input-validation vulnerabilities may also be present in older versions of Gregarius, but this has not been confirmed by Symantec.

Gregarius Multiple Input Validation Vulnerabilities

References:

• Gregarius Homepage (Gregarius)
  
• Gregarius 0.5.2 XSS and SQL Injection Vulnerabilities ([email protected])