Domain Technologie Control 'client/new_account.php' Multiple SQL Injection Vulnerabilities

Bugtraq ID:	33496
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 28 2009 12:00AM
Updated:	Jan 30 2009 09:39PM
Credit:	These issues were disclosed by the vendor.
Vulnerable:	Domain Technologie Control Domain Technologie Control 0.25.1 Domain Technologie Control Domain Technologie Control 0.24.5 r0 Domain Technologie Control Domain Technologie Control 0.24.5 Domain Technologie Control Domain Technologie Control 0.20 Domain Technologie Control Domain Technologie Control 0.17 Domain Technologie Control Domain Technologie Control 0.25 Domain Technologie Control Domain Technologie Control 0.22
Not Vulnerable:	Domain Technologie Control Domain Technologie Control 0.29.16

Domain Technologie Control 'client/new_account.php' Multiple SQL Injection Vulnerabilities

Domain Technologie Control (DTC) is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Versions prior to DTC 0.29.16 are vulnerable.

Domain Technologie Control 'client/new_account.php' Multiple SQL Injection Vulnerabilities

Attackers can use a browser to exploit these issues.

Domain Technologie Control 'client/new_account.php' Multiple SQL Injection Vulnerabilities

Solution:
The vendor released updates to address these issues. Please see the references for more information.

Domain Technologie Control 'client/new_account.php' Multiple SQL Injection Vulnerabilities

References:

• Domain Technologie Control 0.29.16 (Default) (Thomas Goirand)
  
• Domain Technologie Control Homepage (GPLHost)