CJ Ultra Plus 'SID' Cookie Parameter SQL Injection Vulnerability

Bugtraq ID:	31333
Class:	Input Validation Error
CVE:	CVE-2008-4241
Remote:	Yes
Local:	No
Published:	Sep 22 2008 12:00AM
Updated:	May 07 2015 05:23PM
Credit:	SmoG
Vulnerable:	CJ Ultra Plus CJ Ultra Plus 1.0.4 CJ Ultra Plus CJ Ultra Plus 1.0.3
Not Vulnerable:

CJ Ultra Plus 'SID' Cookie Parameter SQL Injection Vulnerability

CJ Ultra Plus is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

CJ Ultra Plus 1.0.4 and prior versions are vulnerable.

CJ Ultra Plus 'SID' Cookie Parameter SQL Injection Vulnerability

Attackers can use a browser to exploit this issue.

The following proof of concept is available:

• /data/vulnerabilities/exploits/31333.pl

CJ Ultra Plus 'SID' Cookie Parameter SQL Injection Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

CJ Ultra Plus 'SID' Cookie Parameter SQL Injection Vulnerability

References:

• CJ Ultra Plus <= 1.0.4 Cookie Remote SQL Injection Exploit (SmoG)