Interact Multiple Remote Vulnerabilities

Bugtraq ID:	17385
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Apr 05 2006 12:00AM
Updated:	Apr 06 2006 05:23PM
Credit:	Pratiksha Doshi is credited with the discovery of these vulnerabilities.
Vulnerable:	Christchurch College of Education Interact 2.1.1 Christchurch College of Education Interact 2.1
Not Vulnerable:

Interact Multiple Remote Vulnerabilities

Interact is prone to multiple remote vulnerabilities. The issues include cross-site scripting, SQL-injection, and information-disclosure vulnerabilities.

Successfully exploiting these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, enumerate valid usernames, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.

Versions 2.1 and 2.1.1 are reportedly vulnerable to these issues; other versions may also be affected.

Interact Multiple Remote Vulnerabilities

These issues can be exploited through a web client.

Interact Multiple Remote Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]

Interact Multiple Remote Vulnerabilities

References:

• Interact Home Page (Christchurch College of Education)