Infinite Core Technologies ICT INDEX.PHP SQL Injection Vulnerability

Bugtraq ID:	18644
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 26 2006 12:00AM
Updated:	Dec 12 2006 09:18PM
Credit:	r0t has been credited for the discovery of this vulnerability.
Vulnerable:	Infinite Core Technologies ICT Gold 1.0
Not Vulnerable:

Infinite Core Technologies ICT INDEX.PHP SQL Injection Vulnerability

Infinite Core Technologies ICT is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

An attacker may be able to exploit this issue to modify the logic of SQL queries. Successful exploits may allow the attacker to compromise the software, retrieve information, or modify data; other consequences are possible as well.

The vendor refutes this issue.

Infinite Core Technologies ICT INDEX.PHP SQL Injection Vulnerability

Attackers can exploit this issue via a web client.

Infinite Core Technologies ICT INDEX.PHP SQL Injection Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].

The vendor refutes this issue.

Infinite Core Technologies ICT INDEX.PHP SQL Injection Vulnerability

References:

• ICT - Infinite Core Technologies vuln. (r0t)
  
• ICT Home Page ( Infinite Core Technologies)