PEEL Multiple SQL Injection Vulnerabilities and Arbitrary File Upload Vulnerability

Bugtraq ID:	28346
Class:	Input Validation Error
CVE:	CVE-2008-1495
Remote:	Yes
Local:	No
Published:	Mar 19 2008 12:00AM
Updated:	May 07 2015 05:32PM
Credit:	NTOS-Team discovered these vulnerabilities.
Vulnerable:	PEEL PEEL 2.7 PEEL PEEL 2.6 PEEL PEEL 1.0 b
Not Vulnerable:

PEEL Multiple SQL Injection Vulnerabilities and Arbitrary File Upload Vulnerability

PEEL is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied data. These issues include multiple SQL-injection vulnerabilities and an arbitrary-file-upload vulnerability.

Exploiting these issues could allow an attacker to compromise the application, execute arbitrary code, access or modify data, or exploit latent vulnerabilities in the underlying database.

PEEL Multiple SQL Injection Vulnerabilities and Arbitrary File Upload Vulnerability

Attackers can use a browser to exploit these issues.

The following proof-of-concept exploit is available:

• /data/vulnerabilities/exploits/28346.php

PEEL Multiple SQL Injection Vulnerabilities and Arbitrary File Upload Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

PEEL Multiple SQL Injection Vulnerabilities and Arbitrary File Upload Vulnerability

References:

• PEEL (PEEL)