Snitz Forums inc_header.ASP SQL Injection Vulnerability
BID:18362
CVE-2006-2959 |Info
Snitz Forums inc_header.ASP SQL Injection Vulnerability
| Bugtraq ID: | 18362 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 10 2006 12:00AM |
| Updated: | Jun 12 2006 06:31PM |
| Credit: | FarhadKey of KAPDA is credited with the discovery of this vulnerability. |
| Vulnerable: |
Snitz Forums 2000 Snitz Forums 2000 3.4 .05 Snitz Forums 2000 Snitz Forums 2000 3.4 .04 Snitz Forums 2000 Snitz Forums 2000 3.4 .03 Snitz Forums 2000 Snitz Forums 2000 3.4 .02 Snitz Forums 2000 Snitz Forums 2000 3.3 .03 Snitz Forums 2000 Snitz Forums 2000 3.3 .02 Snitz Forums 2000 Snitz Forums 2000 3.3 .01 Snitz Forums 2000 Snitz Forums 2000 3.3 Snitz Forums 2000 Snitz Forums 2000 3.1 Snitz Forums 2000 Snitz Forums 2000 3.0 |
| Not Vulnerable: | |
Discussion
Snitz Forums inc_header.ASP SQL Injection Vulnerability
Snitz Forums is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input supplied via cookie values before using it in an SQL query.
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
Snitz Forums is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input supplied via cookie values before using it in an SQL query.
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
Exploit / POC
Snitz Forums inc_header.ASP SQL Injection Vulnerability
This issue can be exploited by specially crafting an HTTP request with a malicious cookie.
This issue can be exploited by specially crafting an HTTP request with a malicious cookie.
Solution / Fix
Snitz Forums inc_header.ASP SQL Injection Vulnerability
Solution:
The vendor has provided a source-code fix for this issue. Please see the "BUG+FIX: 'GROUP' variable not sanitized" reference in the References section.
Solution:
The vendor has provided a source-code fix for this issue. Please see the "BUG+FIX: 'GROUP' variable not sanitized" reference in the References section.
References
Snitz Forums inc_header.ASP SQL Injection Vulnerability
References:
References:
- BUG+FIX: 'GROUP' variable not sanitized (Snitz Forums 2000)
- Snitz Forums 2000 Homepage (Snitz Forums 2000)
- [KAPDA::#47] - Snitz Forum <= 3.4.05 SQL-Injection Vulnerability ([email protected])