TR Forum SQL Injection And Authentication Bypass vulnerabilities

Bugtraq ID:	19834
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 04 2006 12:00AM
Updated:	Sep 06 2006 08:08PM
Credit:	DarkFig is credited with the discovery of this vulnerability.
Vulnerable:	Tr Forum Tr Forum 2.0
Not Vulnerable:

TR Forum SQL Injection And Authentication Bypass vulnerabilities

Tr Forum is prone to an SQL-injection issue and an authentication-bypass issue because the application fails to properly sanitize user-supplied input.

A successful exploit could allow an attacker to compromise the application, access or modify data, exploit vulnerabilities in the underlying database implementation, and gain administrative access to the affected application.

Version 2.0 is vulnerable to these issues; other versions may also be affected.

TR Forum SQL Injection And Authentication Bypass vulnerabilities

Attackers can exploit these issues via a web client.

The following exploit code is available:

• /data/vulnerabilities/exploits/19834.pl

TR Forum SQL Injection And Authentication Bypass vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].

TR Forum SQL Injection And Authentication Bypass vulnerabilities

References:

• Tr Forum Home Page (Tr Forum )
  
• Tr Forum V2.0 Multiple Vulnerabilities ([email protected])