Drupal Jobsearch Module SQL Injection Vulnerability
BID:19420
CVE-2006-4107 |Info
Drupal Jobsearch Module SQL Injection Vulnerability
| Bugtraq ID: | 19420 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 28 2006 12:00AM |
| Updated: | Aug 08 2006 11:15PM |
| Credit: | dotan is credited with the discovery of this vulnerability. |
| Vulnerable: |
Drupal Job Search 4.6 revision 1.3.2.0 |
| Not Vulnerable: |
Drupal Job Search 4.6 revision 1.3.2.1 |
Discussion
Drupal Jobsearch Module SQL Injection Vulnerability
Drupal Jobsearch Module is prone to an SQL-injection vulnerability because it fails to properly sanitize user-supplied input before using it in an SQL query.
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
Versions prior to 4.6 revision 1.3.2.1 are vulnerable.
Drupal Jobsearch Module is prone to an SQL-injection vulnerability because it fails to properly sanitize user-supplied input before using it in an SQL query.
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
Versions prior to 4.6 revision 1.3.2.1 are vulnerable.
Exploit / POC
Drupal Jobsearch Module SQL Injection Vulnerability
Attackers can exploit this issue via a web client.
Attackers can exploit this issue via a web client.
Solution / Fix
Drupal Jobsearch Module SQL Injection Vulnerability
Solution:
The vendor has released version 4.6 revision 1.3.2.1 to address this issue. Please see the references for more information.
Solution:
The vendor has released version 4.6 revision 1.3.2.1 to address this issue. Please see the references for more information.
References
Drupal Jobsearch Module SQL Injection Vulnerability
References:
References:
- Drupal Modules Home Page (Drupal)
- Easylinks multiple vulnerabilities (Drupal)