DSDownload Multiple SQL-Injection Vulnerabilities

Bugtraq ID:	17116
Class:	Input Validation Error
CVE:	CVE-2006-1232
Remote:	Yes
Local:	No
Published:	Mar 15 2006 12:00AM
Updated:	Mar 27 2006 07:39PM
Credit:	Aliaksandr Hartsuyeu is credited with the discovery of these vulnerabilities.
Vulnerable:	DSPortal DSDownload 1.0
Not Vulnerable:

DSDownload Multiple SQL-Injection Vulnerabilities

DSDownload is prone to multiple SQL-injection vulnerabilities. The application fails to properly sanitize user-supplied input before using it in SQL queries.

This will allow an attacker to inject arbitrary SQL logic into the vulnerable parameters and scripts. As a result, the attacker may be able to access or modify sensitive information, compromise the application, or even compromise the underlying database. Other attacks are possible.

DSDownload Multiple SQL-Injection Vulnerabilities

This issue can be exploited through a web client.

The following example URI is available:

http://www.example.com/dsdownload/downloads.php? category=999'% 20union%20select% 206,2,3,4,5, 1,7,8/*

DSDownload Multiple SQL-Injection Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]

DSDownload Multiple SQL-Injection Vulnerabilities

References:

• DSDownload Multiple SQL Injection Vulnerabilities (eVuln.com)
  
• DSDownload Web Site (DSPortal)