KEEP Toolkit 'lib/patUser.php' SQL Injection Vulnerability

Bugtraq ID:	33425
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 23 2009 12:00AM
Updated:	Jan 27 2009 08:29PM
Credit:	The vendor.
Vulnerable:	KEEP Toolkit KEEP Toolkit 2.5
Not Vulnerable:	KEEP Toolkit KEEP Toolkit 2.5.1

KEEP Toolkit 'lib/patUser.php' SQL Injection Vulnerability

KEEP Toolkit is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Versions prior to KEEP Toolkit 2.5.1 are vulnerable.

KEEP Toolkit 'lib/patUser.php' SQL Injection Vulnerability

Attackers can use a browser to exploit this issue.

KEEP Toolkit 'lib/patUser.php' SQL Injection Vulnerability

Solution:
The vendor released KEEP Toolkit 2.5.1 to address this issue. Please see the references for more information.


KEEP Toolkit KEEP Toolkit 2.5

• KEEP Toolkit keep-2_5_1.tar.gz
  http://downloads.sourceforge.net/keeptoolkit/keep-2_5_1.tar.gz?modtime =1232749007&big_mirror=0

KEEP Toolkit 'lib/patUser.php' SQL Injection Vulnerability

References:

• KEEP Toolkit Project Page (KEEP Toolkit)
  
• Release Name: Security Fix (KEEP Toolkit)