BID:19552

Owl Intranet Engine Multiple Vulnerabilities

CVE-2006-4211 | CVE-2006-4212 |

Info

Owl Intranet Engine Multiple Vulnerabilities

Bugtraq ID:	19552
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 16 2006 12:00AM
Updated:	Aug 17 2006 08:35PM
Credit:	Fukumori is credited with the discovery of these vulnerabilities.
Vulnerable:	Owl Owl Intranet Engine 0.80 Owl Owl Intranet Engine 0.73 Owl Owl Intranet Engine 0.72 Owl Owl Intranet Engine 0.71 Owl Owl Intranet Engine 0.9 Owl Owl Intranet Engine 0.7 Owl Owl Intranet Engine 0.6 Owl Owl Intranet Engine 0.82

Not Vulnerable:	Owl Owl Intranet Engine 0.9.1

Discussion

Owl Intranet Engine Multiple Vulnerabilities

Owl Intranet Engine is vulnerable to cross-site scripting and SQL-injection vulnerabilities.

An attacker can exploit the cross-site scripting issue to execute arbitrary HTML and script code in the context of the affected site.

An attacker can exploit the SQL-injection issue to compromise the software, expose or modify sensitive information, or exploit vulnerabilities in the database itself.

Version 0.9.0 of Owl Intranet Engine is vulnerable; earlier versions may also be vulnerable.

Exploit / POC

Owl Intranet Engine Multiple Vulnerabilities

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]