Neocrome Seditio PLUG.PHP SQL Injection Vulnerability

Bugtraq ID:	26655
Class:	Input Validation Error
CVE:	CVE-2007-6202
Remote:	Yes
Local:	No
Published:	Nov 29 2007 12:00AM
Updated:	Dec 05 2007 04:52PM
Credit:	InATeam is credited with the discovery of this vulnerability.
Vulnerable:	Neocrome Seditio 121
Not Vulnerable:

Neocrome Seditio PLUG.PHP SQL Injection Vulnerability

Seditio is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Versions of Seditio 121 released prior to November 30, 2007 are vulnerable.

Neocrome Seditio PLUG.PHP SQL Injection Vulnerability

Attackers can use a browser to exploit this issue.

The following proof of concept is available:

• /data/vulnerabilities/exploits/Seditio_sql.php

Neocrome Seditio PLUG.PHP SQL Injection Vulnerability

Solution:
Versions of Seditio 121 released on or after November 30, 2007 are not vulnerable to this issue. Please see the references for more information.

Neocrome Seditio PLUG.PHP SQL Injection Vulnerability

References:

• Search plugin, security patch (Neocrome)
  
• Seditio Homepage (Neocrome )