OlateDownload Multiple Input Validation Vulnerabilities
BID:20278
Info
OlateDownload Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 20278 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 30 2006 12:00AM |
| Updated: | Oct 02 2006 05:05PM |
| Credit: | Hessam-x is credited with the discovery of these vulnerabilities. |
| Vulnerable: |
Olate OlateDownload 3.4 |
| Not Vulnerable: | |
Discussion
OlateDownload Multiple Input Validation Vulnerabilities
OlateDownload is prone to multiple input-validation vulnerabilities, including HTML-injection and SQL-injection issues, because the application fails to properly sanitize user-supplied input.
A successful exploit of these vulnerabilities could allow an attacker to inject hostile HTML and script code into vulnerable sections of the application, steal cookie-based authentication credentials from legitimate users of the site, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.
OlateDownload version 3.4.0 is vulnerable.
OlateDownload is prone to multiple input-validation vulnerabilities, including HTML-injection and SQL-injection issues, because the application fails to properly sanitize user-supplied input.
A successful exploit of these vulnerabilities could allow an attacker to inject hostile HTML and script code into vulnerable sections of the application, steal cookie-based authentication credentials from legitimate users of the site, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.
OlateDownload version 3.4.0 is vulnerable.
Exploit / POC
OlateDownload Multiple Input Validation Vulnerabilities
Attackers can exploit these issues via a web client.
Sample URIs have been provided:
http://www.example.com/details.php?page=%BF%27%22%28&file=1
http://www.example.com/search.php?query=%BF%27%22%28
Attackers can exploit these issues via a web client.
Sample URIs have been provided:
http://www.example.com/details.php?page=%BF%27%22%28&file=1
http://www.example.com/search.php?query=%BF%27%22%28
Solution / Fix
OlateDownload Multiple Input Validation Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].
References
OlateDownload Multiple Input Validation Vulnerabilities
References:
References: