Jamit Job Board 'index.php' SQL Injection Vulnerability

Bugtraq ID:	32478
Class:	Input Validation Error
CVE:	CVE-2008-5295
Remote:	Yes
Local:	No
Published:	Nov 25 2008 12:00AM
Updated:	May 07 2015 05:20PM
Credit:	XaDoS
Vulnerable:	Jamit Job Board 3.4.5
Not Vulnerable:	Jamit Job Board 3.4.10 Jamit Job Board 3.4.6

Jamit Job Board 'index.php' SQL Injection Vulnerability

Jamit Job Board is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Versions prior to Jamit Job Board 3.4.6 are vulnerable.

Jamit Job Board 'index.php' SQL Injection Vulnerability

Attackers can use a browser to exploit this issue.

The following example URIs are available:

http://www.example.com/index.php?show_emp=1%20and%20substring(@@version,1,1)=4
http://www.example.com/index.php?show_emp=1%20and%20substring(@@version,1,1)=5

Jamit Job Board 'index.php' SQL Injection Vulnerability

Solution:
The vendor has released updates; please see the references for more information.

Jamit Job Board 'index.php' SQL Injection Vulnerability

References:

• Jamit Job Board Homepage (Jamit)