PHProjekt Multiple SQL Injection Vulnerabilities

Bugtraq ID:	22955
Class:	Input Validation Error
CVE:	CVE-2007-1575
Remote:	Yes
Local:	No
Published:	Mar 14 2007 12:00AM
Updated:	Jun 20 2007 03:39AM
Credit:	Alexios Fakos is credited with the discovery of these vulnerabilities.
Vulnerable:	PHProjekt PHProjekt 5.2 PHProjekt PHProjekt 5.1.2 PHProjekt PHProjekt 5.1.1 PHProjekt PHProjekt 5.1 Gentoo Linux
Not Vulnerable:	PHProjekt PHProjekt 5.2.1

PHProjekt Multiple SQL Injection Vulnerabilities

PHProjekt is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

PHProjekt 5.2.0 and prior versions are vulnerable to these issues.

PHProjekt Multiple SQL Injection Vulnerabilities

Attackers can use a browser to exploit these issues.

PHProjekt Multiple SQL Injection Vulnerabilities

Solution:
The vendor has released version 5.2.1 to address these issues.


PHProjekt PHProjekt 5.1

• PHProjekt PHProjekt 5.2.1
  http://www.phprojekt.com/download/phprojekt.tar.gz

PHProjekt PHProjekt 5.1.1

• PHProjekt PHProjekt 5.2.1
  http://www.phprojekt.com/download/phprojekt.tar.gz

PHProjekt PHProjekt 5.1.2

• PHProjekt PHProjekt 5.2.1
  http://www.phprojekt.com/download/phprojekt.tar.gz

PHProjekt PHProjekt 5.2

• PHProjekt PHProjekt 5.2.1
  http://www.phprojekt.com/download/phprojekt.tar.gz

PHProjekt Multiple SQL Injection Vulnerabilities

References:

• n.runs-SA-2007.003 SQL Injection PHProjekt 5.2.0 (n.runs AG)
  
• PHProjekt Homepage (PHProjekt Team)
  
• n.runs-SA-2007.003 - PHProjekt 5.2.0 - SQL Injection (n.runs)