ProManager Note.PHP SQL Injection Vulnerability

Bugtraq ID:	19728
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 26 2006 12:00AM
Updated:	Aug 31 2006 08:39PM
Credit:	Kacper has been credited with the discovery of this vulnerability.
Vulnerable:	ProManager ProManager 0.73
Not Vulnerable:

ProManager Note.PHP SQL Injection Vulnerability

ProManager is prone to an SQL-injection vulnerability because it fails to properly sanitize user-supplied input before using it in an SQL query.

An attacker may be able to exploit this issue to modify the logic of SQL queries. Successful exploits may allow the attacker to compromise the software, add administrative users, retrieve information, or modify data; other consequences are possible as well.

ProManager version 0.73 is reported vulnerable; other versions may also be affected.

ProManager Note.PHP SQL Injection Vulnerability

Attackers can exploit this issue via a web client.

A proof of concept is available.

• /data/vulnerabilities/exploits/ProManager_sql_inj_poc.txt

ProManager Note.PHP SQL Injection Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].

ProManager Note.PHP SQL Injection Vulnerability

References:

• proManager <= 0.73 (Add Admin) SQL Injection Vulnerabilities (Kacper)
  
• ProManager Homepage (Promanager)