Unobtrusive AJAX Star Rating Bar Multiple Input Validation Vulnerabilities
BID:24840
Info
Unobtrusive AJAX Star Rating Bar Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 24840 |
| Class: | Input Validation Error |
| CVE: |
CVE-2007-3686 CVE-2007-3684 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 09 2007 12:00AM |
| Updated: | Jul 06 2016 02:17PM |
| Credit: | sullo from CIRT.net is credited with the discovery of these vulnerabilities. |
| Vulnerable: |
Masuga Design Unobtrusive AJAX Star Rating Bar 1.1 |
| Not Vulnerable: |
Masuga Design Unobtrusive AJAX Star Rating Bar 1.2.2 Masuga Design Unobtrusive AJAX Star Rating Bar 1.2 |
Discussion
Unobtrusive AJAX Star Rating Bar Multiple Input Validation Vulnerabilities
Unobtrusive AJAX Star Rating Bar is prone to input-validation vulnerabilities, including an SQL-injection issue, a security-bypass issue, and a cross-site scripting issue, because the application fails to sanitize user-supplied input.
A successful exploit may allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, and bypass certain security restriction to inject arbitrary HTTP header and body data.
Versions prior to Unobtrusive AJAX Star Rating Bar 1.2.0 are affected.
Unobtrusive AJAX Star Rating Bar is prone to input-validation vulnerabilities, including an SQL-injection issue, a security-bypass issue, and a cross-site scripting issue, because the application fails to sanitize user-supplied input.
A successful exploit may allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, and bypass certain security restriction to inject arbitrary HTTP header and body data.
Versions prior to Unobtrusive AJAX Star Rating Bar 1.2.0 are affected.
Exploit / POC
Unobtrusive AJAX Star Rating Bar Multiple Input Validation Vulnerabilities
Attackers can use a browser to exploit these issues.
Attackers can use a browser to exploit these issues.
Solution / Fix
Unobtrusive AJAX Star Rating Bar Multiple Input Validation Vulnerabilities
Solution:
The vendor released an update to address this issue. Please see the references for more information.
Masuga Design Unobtrusive AJAX Star Rating Bar 1.1
Solution:
The vendor released an update to address this issue. Please see the references for more information.
Masuga Design Unobtrusive AJAX Star Rating Bar 1.1
-
Masuga Design Unobtrusive AJAX Star Rating Bar 1.2.2
http://www.masugadesign.com/download.php?ajaxstarrater_v122.zip
References
Unobtrusive AJAX Star Rating Bar Multiple Input Validation Vulnerabilities
References:
References:
- CIRT-200701: Unobtrusive Ajax Star Rating Bar / Multiple Issues (CIRT)
- Vendor Homepage (Masuga Design)