Multiple ActiveWebSoftwares Products Login Parameters SQL Injection Vulnerabilities
BID:32533
Info
Multiple ActiveWebSoftwares Products Login Parameters SQL Injection Vulnerabilities
| Bugtraq ID: | 32533 |
| Class: | Input Validation Error |
| CVE: |
CVE-2008-5627 CVE-2008-5631 CVE-2008-5633 CVE-2008-5634 CVE-2008-5635 CVE-2008-5632 CVE-2008-5641 CVE-2008-5959 CVE-2008-5973 CVE-2008-5974 CVE-2008-6286 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 29 2008 12:00AM |
| Updated: | Mar 10 2009 09:16PM |
| Credit: | ((?3d D3v!L)), Cyber-Zone, OffensiveTrack |
| Vulnerable: |
Active Web Softwares eWebquiz 8 Active Web Softwares ActiveVotes 2.2 Active Web Softwares Active Websurvey 9.1 Active Web Softwares Active Web Mail 4 Active Web Softwares Active Web Helpdesk 2 Active Web Softwares Active Trade 2.0 Active Web Softwares Active Time Billing 3.2 Active Web Softwares Active Test 2.1 Active Web Softwares Active Price Comparison 4 Active Web Softwares Active Photo Gallery 6.2 Active Web Softwares Active Newsletter 4.3 Active Web Softwares Active Membership 2 Active Web Softwares Active Force Matrix 2 |
| Not Vulnerable: | |
Discussion
Multiple ActiveWebSoftwares Products Login Parameters SQL Injection Vulnerabilities
Multiple ActiveWebSoftwares products are prone to SQL-injection vulnerabilities because they fail to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
The following applications are vulnerable:
ActiveVotes 2.2
Active Force Matrix 2
Active Trade 2
Active Price Comparison 4
Active Test 2.1
eWebQuiz 8
Active Newsletter 4.3
Active Web Mail 4
Active Websurvey 9.1
Active Membership 2
Active Web Helpdesk 2
Active Photo Gallery 6.2
Active Time Billing 3.2
Multiple ActiveWebSoftwares products are prone to SQL-injection vulnerabilities because they fail to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
The following applications are vulnerable:
ActiveVotes 2.2
Active Force Matrix 2
Active Trade 2
Active Price Comparison 4
Active Test 2.1
eWebQuiz 8
Active Newsletter 4.3
Active Web Mail 4
Active Websurvey 9.1
Active Membership 2
Active Web Helpdesk 2
Active Photo Gallery 6.2
Active Time Billing 3.2
Exploit / POC
Multiple ActiveWebSoftwares Products Login Parameters SQL Injection Vulnerabilities
Attackers can use a browser to exploit these issues.
The following example input is available:
username: r0' or ' 1=1--
password: r0' or ' 1=1--
email: r0' or ' 1=1--
Attackers can use a browser to exploit these issues.
The following example input is available:
username: r0' or ' 1=1--
password: r0' or ' 1=1--
email: r0' or ' 1=1--
Solution / Fix
Multiple ActiveWebSoftwares Products Login Parameters SQL Injection Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Multiple ActiveWebSoftwares Products Login Parameters SQL Injection Vulnerabilities
References:
References:
- Active Web Softwares Homepage (Active Web Softwares)