AlstraSoft Affiliate Network Pro Multiple Input Validation Vulnerabilities
BID:25026
Info
AlstraSoft Affiliate Network Pro Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 25026 |
| Class: | Input Validation Error |
| CVE: |
CVE-2007-4081 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 23 2007 12:00AM |
| Updated: | May 07 2015 05:36PM |
| Credit: | Lostmon is credited with the discovery of these vulnerabilities. |
| Vulnerable: |
AlstraSoft Affiliate Network Pro 8.0 |
| Not Vulnerable: | |
Discussion
AlstraSoft Affiliate Network Pro Multiple Input Validation Vulnerabilities
AlstraSoft Affiliate Network Pro is affected by multiple input-validation vulnerabilities. These issues include multiple cross-site scripting isues and SQL-injection issues.
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, execute arbitrary script code in the context of the webserver process, access or modify data, or exploit latent vulnerabilities in the underlying database.
AlstraSoft Affiliate Network Pro is affected by multiple input-validation vulnerabilities. These issues include multiple cross-site scripting isues and SQL-injection issues.
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, execute arbitrary script code in the context of the webserver process, access or modify data, or exploit latent vulnerabilities in the underlying database.
Exploit / POC
AlstraSoft Affiliate Network Pro Multiple Input Validation Vulnerabilities
To exploit the cross-site scripting issues, an attacker must entice an unsuspecting victim into following a malicious URI. The attacker can use a browser to exploit the SQL-injection issue.
The following proofs of concept have been provided:
To exploit the cross-site scripting issues, an attacker must entice an unsuspecting victim into following a malicious URI. The attacker can use a browser to exploit the SQL-injection issue.
The following proofs of concept have been provided:
Solution / Fix
AlstraSoft Affiliate Network Pro Multiple Input Validation Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
AlstraSoft Affiliate Network Pro Multiple Input Validation Vulnerabilities
References:
References:
- AlstraSoft Multiple products multiple Vulnerabilities (Lostmon)
- Vendor Homepage (AlstraSoft)