Plogger 'plog-rss.php' SQL Injection Vulnerability
BID:26958
Info
Plogger 'plog-rss.php' SQL Injection Vulnerability
| Bugtraq ID: | 26958 |
| Class: | Input Validation Error |
| CVE: |
CVE-2007-6587 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 20 2007 12:00AM |
| Updated: | May 07 2015 05:34PM |
| Credit: | D. Martin Gomez is credited with the discovery of this vulnerability. |
| Vulnerable: |
Plogger Plogger 1.0 Beta 3.0 |
| Not Vulnerable: | |
Discussion
Plogger 'plog-rss.php' SQL Injection Vulnerability
Plogger is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
This issue affects Plogger 1.0 Beta 3; other versions may also be affected.
Plogger is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
This issue affects Plogger 1.0 Beta 3; other versions may also be affected.
Exploit / POC
Plogger 'plog-rss.php' SQL Injection Vulnerability
Attackers can use a browser to exploit this issue.
Attackers can use a browser to exploit this issue.
Solution / Fix
Plogger 'plog-rss.php' SQL Injection Vulnerability
Solution:
The vendor has released a fix in their version control system. Please see the references for more information.
Solution:
The vendor has released a fix in their version control system. Please see the references for more information.
References
Plogger 'plog-rss.php' SQL Injection Vulnerability
References:
References:
- Plogger Changeset 489 (Plogger)
- Plogger Homepage (Plogger)
- Plogger SQL Injection Vulnerability (MWR InfoSecurity)