VisualShapers EzContents Headeruserdata.PHP SQL Injection Vulnerability

Bugtraq ID:	19777
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 30 2006 12:00AM
Updated:	Sep 04 2006 07:38PM
Credit:	DarkFig is credited with the discovery of this vulnerability.
Vulnerable:	VisualShapers ezContents 2.0.3
Not Vulnerable:

VisualShapers EzContents Headeruserdata.PHP SQL Injection Vulnerability

ezContents is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

VisualShapers EzContents Headeruserdata.PHP SQL Injection Vulnerability

An attacker can exploit this issue using a web browser.

The following example exploit is available:

• /data/vulnerabilities/exploits/19777.html

VisualShapers EzContents Headeruserdata.PHP SQL Injection Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].

VisualShapers EzContents Headeruserdata.PHP SQL Injection Vulnerability

References:

• ezContents Homepage (Visual Shaper)
  
• ezContents Version 2.0.3 Remote/Local File Inclusion, SQL ( DarkFig)