Akarru Social BookMarking Engine Users.PHP SQL Injection Vulnerability

Bugtraq ID:	16989
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 06 2006 12:00AM
Updated:	Mar 09 2006 10:55AM
Credit:	Ricardo Galli is credited with the discovery of this vulnerability.
Vulnerable:	Akarru Social BookMarking Engine 0.4.3 3 Akarru Social BookMarking Engine 0.4.3 2
Not Vulnerable:	Akarru Social BookMarking Engine 0.4.3 4

Akarru Social BookMarking Engine Users.PHP SQL Injection Vulnerability


Akarru Social BookMarking Engine is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.


Versions prior to 0.4.3.4 are vulnerable; other versions may also be affected.

Akarru Social BookMarking Engine Users.PHP SQL Injection Vulnerability

This issue can be exploited through a web client.

Akarru Social BookMarking Engine Users.PHP SQL Injection Vulnerability

Solution:

The vendor has released version 0.4.3.4 to address this issue.


Akarru Social BookMarking Engine 0.4.3 2

• Akarru akarru-0.4.3.4.tgz
  http://prdownloads.sourceforge.net/akarru/akarru-0.4.3.4.tgz

Akarru Social BookMarking Engine 0.4.3 3

• Akarru akarru-0.4.3.4.tgz
  http://prdownloads.sourceforge.net/akarru/akarru-0.4.3.4.tgz

Akarru Social BookMarking Engine Users.PHP SQL Injection Vulnerability

References:

• Akarru Revision History 0.4.3.4 (Akarru)
  
• Akarru Web Site (Akarru)