Samedia LandShop LS.PHP Multiple Input Validation Vulnerabilities

Bugtraq ID:	20989
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 09 2006 12:00AM
Updated:	Nov 24 2006 05:35PM
Credit:	Laurent Gaffi and Benjamin Moss are credited with the discovery of these vulnerabilities.
Vulnerable:	SAMEDIA LandShop 0.6.3 SAMEDIA LandShop 0
Not Vulnerable:	SAMEDIA LandShop 0.8.2

Samedia LandShop LS.PHP Multiple Input Validation Vulnerabilities

LandShop is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, access or modify sensitive data, execute arbitrary script code in the context of the application, compromise the application, and possibly exploit latent vulnerabilities in the underlying system; other attacks are also possible.

Samedia LandShop LS.PHP Multiple Input Validation Vulnerabilities

An attacker can exploit these issues via a web client. In some cases, the attacker must entice a victim user to follow a malicious URI.

The following proof-of-concept URIs are available:

• /data/vulnerabilities/exploits/20989.html

Samedia LandShop LS.PHP Multiple Input Validation Vulnerabilities

Solution:
The vendor has released version 0.8.2 to address this issue.


SAMEDIA LandShop 0

• SAMEDIA landshop-0.8.2.tgz
  http://www.landshop.gr/en/download.htm#

SAMEDIA LandShop 0.6.3

• SAMEDIA landshop-0.8.2.tgz
  http://www.landshop.gr/en/download.htm#