TYPO3 JobControl Extension Unspecified Cross-Site Scripting and SQL-Injection Vulnerabilities
BID:29828
Info
TYPO3 JobControl Extension Unspecified Cross-Site Scripting and SQL-Injection Vulnerabilities
| Bugtraq ID: | 29828 |
| Class: | Input Validation Error |
| CVE: |
CVE-2008-6688 CVE-2008-6689 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 19 2008 12:00AM |
| Updated: | Apr 24 2009 11:16PM |
| Credit: | Marc Bastian Heinrichs |
| Vulnerable: |
Typo3 JobControl 1.15 |
| Not Vulnerable: |
Typo3 JobControl 1.15.1 |
Discussion
TYPO3 JobControl Extension Unspecified Cross-Site Scripting and SQL-Injection Vulnerabilities
The JobControl extension for TYPO3 is prone to a cross-site scripting vulnerability and an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input.
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Versions prior to JobControl 1.15.1 are vulnerable.
The JobControl extension for TYPO3 is prone to a cross-site scripting vulnerability and an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input.
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Versions prior to JobControl 1.15.1 are vulnerable.
Exploit / POC
TYPO3 JobControl Extension Unspecified Cross-Site Scripting and SQL-Injection Vulnerabilities
An attacker can exploit these issues via a browser. To exploit a cross-site scripting issue, the attacker must entice an unsuspecting victim to follow a malicious URI.
An attacker can exploit these issues via a browser. To exploit a cross-site scripting issue, the attacker must entice an unsuspecting victim to follow a malicious URI.
Solution / Fix
TYPO3 JobControl Extension Unspecified Cross-Site Scripting and SQL-Injection Vulnerabilities
Solution:
The vendor released JobControl 1.15.1 to address these issues. Please see the references for more information.
Typo3 JobControl 1.15
Solution:
The vendor released JobControl 1.15.1 to address these issues. Please see the references for more information.
Typo3 JobControl 1.15
-
Typo3 dmmjobcontrol_1.15.2.t3x
http://typo3.org/fileadmin/ter/d/m/dmmjobcontrol_1.15.2.t3x
References
TYPO3 JobControl Extension Unspecified Cross-Site Scripting and SQL-Injection Vulnerabilities
References:
References: