OpenBiblio Multiple Input Validation Vulnerabilities

Bugtraq ID:	20301
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 02 2006 12:00AM
Updated:	Oct 03 2006 06:05PM
Credit:	The vendor reported these issues.
Vulnerable:	OpenBiblio OpenBiblio 0.5.1 OpenBiblio OpenBiblio 0.3 OpenBiblio OpenBiblio 0.2.1 OpenBiblio OpenBiblio 0.2
Not Vulnerable:	OpenBiblio OpenBiblio 0.5.2

OpenBiblio Multiple Input Validation Vulnerabilities

OpenBiblio is prone to multiple input-validation vulnerabilities because the application fails to sufficiently sanitize user-supplied input. These include multiple local file-include vulnerabilties and an SQL-injection vulnerability.

A successful exploit may allow an attacker to compromise the application, access sensitive information, modify data, or exploit latent vulnerabilities in the underlying database implementation.

OpenBiblio Multiple Input Validation Vulnerabilities

Attackers can exploit these issues via a web client.

OpenBiblio Multiple Input Validation Vulnerabilities

Solution:
The vendor has released an update to address the local file-include issues. Please see the references for more information.

OpenBiblio Multiple Input Validation Vulnerabilities

References:

• OpenBiblio Change Log (OpenBiblio)
  
• OpenBiblio Home Page (OpenBiblio)