FileRun Multiple SQL Injection and Cross-Site Scripting Vulnerabilities

Bugtraq ID:	23752
Class:	Input Validation Error
CVE:	CVE-2007-2469
Remote:	Yes
Local:	No
Published:	May 01 2007 12:00AM
Updated:	May 07 2015 05:39PM
Credit:	r0t is credited with the discovery of these vulnerabilities.
Vulnerable:	FileRun FileRun 1.0
Not Vulnerable:

FileRun Multiple SQL Injection and Cross-Site Scripting Vulnerabilities

FileRun is prone to multiple input-validation vulnerabilities, including SQL-injection and cross-site scripting issues, because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

FileRun 1.0 and prior versions are vulnerable to these issues.

FileRun Multiple SQL Injection and Cross-Site Scripting Vulnerabilities

Attackers can use a browser to exploit these issues.

FileRun Multiple SQL Injection and Cross-Site Scripting Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

FileRun Multiple SQL Injection and Cross-Site Scripting Vulnerabilities

References:

• FileRun Vuln. (r0t)
  
• Vendor Homepage (FileRun)