eLineStudio Site Composer Multiple Input Validation and Unauthorized Access Vulnerabilities
BID:29812
Info
eLineStudio Site Composer Multiple Input Validation and Unauthorized Access Vulnerabilities
| Bugtraq ID: | 29812 |
| Class: | Input Validation Error |
| CVE: |
CVE-2008-2863 CVE-2008-2861 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 19 2008 12:00AM |
| Updated: | Jul 05 2016 10:01PM |
| Credit: | AmnPardaz Security Research & Penetration Testing Group <admin[4t}bugreport{d0t]ir> |
| Vulnerable: |
eLineStudio eLineStudio Site Composer 2.6 |
| Not Vulnerable: | |
Discussion
eLineStudio Site Composer Multiple Input Validation and Unauthorized Access Vulnerabilities
eLineStudio Site Composer is prone to multiple vulnerabilities because it fails to properly validate input and restrict access. These issues include two SQL-injection issues, four cross-site scripting issues, and two vulnerabilities that allow unauthorized access to administrative functions.
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, create or delete folders on the webserver, or exploit latent vulnerabilities in the underlying database.
eLineStudio Site Composer 2.6 is vulnerable; other versions may also be affected.
eLineStudio Site Composer is prone to multiple vulnerabilities because it fails to properly validate input and restrict access. These issues include two SQL-injection issues, four cross-site scripting issues, and two vulnerabilities that allow unauthorized access to administrative functions.
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, create or delete folders on the webserver, or exploit latent vulnerabilities in the underlying database.
eLineStudio Site Composer 2.6 is vulnerable; other versions may also be affected.
Exploit / POC
eLineStudio Site Composer Multiple Input Validation and Unauthorized Access Vulnerabilities
An attacker can exploit these issues via a browser. To exploit a cross-site scripting vulnerability, the attacker must entice a victim user to follow a malicious URI.
The following exploit examples are available:
An attacker can exploit these issues via a browser. To exploit a cross-site scripting vulnerability, the attacker must entice a victim user to follow a malicious URI.
The following exploit examples are available:
Solution / Fix
eLineStudio Site Composer Multiple Input Validation and Unauthorized Access Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
eLineStudio Site Composer Multiple Input Validation and Unauthorized Access Vulnerabilities
References:
References: