myStats Security Bypass and SQL Injection Vulnerabilities

Bugtraq ID:	31772
Class:	Unknown
CVE:	CVE-2008-4644 CVE-2008-4643
Remote:	Yes
Local:	No
Published:	Oct 15 2008 12:00AM
Updated:	Jul 06 2016 02:18PM
Credit:	JosS
Vulnerable:	myWebland myStats 0
Not Vulnerable:

myStats Security Bypass and SQL Injection Vulnerabilities

myStats is prone to a security-bypass vulnerability and an SQL-injection issue.

Exploiting the security-bypass issue may allow an attacker to bypass certain security restrictions and perform unauthorized actions. The attacker can exploit the SQL-injection issue by manipulating the SQL query logic to carry out unauthorized actions on the underlying database. This may compromise the application and may aid in further attacks.

myStats Security Bypass and SQL Injection Vulnerabilities

Attackers can exploit the issues via a browser.

The following exploit and proof of concept are available:

• /data/vulnerabilities/exploits/31772-block-ip.pl
• /data/vulnerabilities/exploits/31772-sql-injection.pl

myStats Security Bypass and SQL Injection Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

myStats Security Bypass and SQL Injection Vulnerabilities

References:

• myStats Download page (myWebland)