ZeusCMS SQL Injection Vulnerability and Information Disclosure Vulnerability

Bugtraq ID:	27058
Class:	Input Validation Error
CVE:	CVE-2007-6623 CVE-2007-6622
Remote:	Yes
Local:	No
Published:	Dec 28 2007 12:00AM
Updated:	Jul 05 2016 10:00PM
Credit:	EgiX is credited with the discovery of these vulnerabilities
Vulnerable:	ZeusCMS ZeusCMS 0.3
Not Vulnerable:

ZeusCMS SQL Injection Vulnerability and Information Disclosure Vulnerability

ZeusCMS is prone to an SQL-injection vulnerability and an information-disclosure vulnerability because the application fails to sufficiently sanitize user-supplied data.

A successful attack could allow an attacker to obtain sensitive information, compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

ZeusCMS 0.3 is vulnerable; other versions may also be affected.

ZeusCMS SQL Injection Vulnerability and Information Disclosure Vulnerability

Attackers can use a browser to exploit these issues.

ZeusCMS SQL Injection Vulnerability and Information Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

ZeusCMS SQL Injection Vulnerability and Information Disclosure Vulnerability

References:

• ZeusCMS Homepage (ZeusCMS)