JIRAN Cool Messenger SQL Injection Vulnerability

Bugtraq ID:	19669
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 23 2006 12:00AM
Updated:	Aug 30 2006 10:53PM
Credit:	Tan Chew Keong discovered this issue.
Vulnerable:	JIRAN Cool Messenger 5.5 (5,65,12,12) JIRAN Cool Manager 5.0 (5,60,90,27)
Not Vulnerable:	JIRAN Cool Messenger 5.5 (5,65,12,13) JIRAN Cool Manager 5.0 (5,60,90,28)

JIRAN Cool Messenger SQL Injection Vulnerability

Cool Messenger is prone to an SQL-injection vulnerability because it fails to properly sanitize user-supplied input before being used as input to SQL queries.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

JIRAN Cool Messenger SQL Injection Vulnerability

Attackers can exploit this issue via a web client.

JIRAN Cool Messenger SQL Injection Vulnerability

Solution:
Reports indicate that the vendor has released upgrades to address this issue. Symantec has not confirmed this.

JIRAN Cool Messenger SQL Injection Vulnerability

References:

• Cool Messenger Home Page (JIRAN)
  
• Cool Messenger Server SQL Injection Vulnerability (Tan Chew Keong)