WGCC Web Group Communication Center Cross-Site Scripting and SQL Injection Vulnerabilities
BID:29188
Info
WGCC Web Group Communication Center Cross-Site Scripting and SQL Injection Vulnerabilities
| Bugtraq ID: | 29188 |
| Class: | Input Validation Error |
| CVE: |
CVE-2008-2445 |
| Remote: | Yes |
| Local: | No |
| Published: | May 13 2008 12:00AM |
| Updated: | May 07 2015 05:28PM |
| Credit: | myvx |
| Vulnerable: |
WGCC WGCC 1.0.3 |
| Not Vulnerable: | |
Discussion
WGCC Web Group Communication Center Cross-Site Scripting and SQL Injection Vulnerabilities
WGCC (Web Group Communication Center) is prone to multiple input-validation vulnerabilities, including a cross-site scripting issue and multiple SQL-injection issues, because it fails to sufficiently sanitize user-supplied data.
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
WGCC 1.0.3 is vulnerable; other versions may also be affected.
WGCC (Web Group Communication Center) is prone to multiple input-validation vulnerabilities, including a cross-site scripting issue and multiple SQL-injection issues, because it fails to sufficiently sanitize user-supplied data.
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
WGCC 1.0.3 is vulnerable; other versions may also be affected.
Exploit / POC
WGCC Web Group Communication Center Cross-Site Scripting and SQL Injection Vulnerabilities
An attacker can exploit these issues via a browser. To exploit a cross-site scripting vulnerability, the attacker must entice a victim user to follow a malicious URI.
The following example URIs are available:
An attacker can exploit these issues via a browser. To exploit a cross-site scripting vulnerability, the attacker must entice a victim user to follow a malicious URI.
The following example URIs are available:
Solution / Fix
WGCC Web Group Communication Center Cross-Site Scripting and SQL Injection Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
NOTE: Reports indicate that the vendor may have released an update to address these issues, but this has not been confirmed. Contact the vendor for details on the availability of updates.
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
NOTE: Reports indicate that the vendor may have released an update to address these issues, but this has not been confirmed. Contact the vendor for details on the availability of updates.
References
WGCC Web Group Communication Center Cross-Site Scripting and SQL Injection Vulnerabilities
References:
References: