glFusion Multiple SQL Injection Vulnerabilities
BID:34281
Info
glFusion Multiple SQL Injection Vulnerabilities
| Bugtraq ID: | 34281 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 29 2009 12:00AM |
| Updated: | Apr 02 2009 07:26PM |
| Credit: | Nine:Situations:Group::bookoo |
| Vulnerable: |
glFusion glFusion 1.1.2 glFusion glFusion 1.1.1 glFusion glFusion 1.1 |
| Not Vulnerable: | |
Discussion
glFusion Multiple SQL Injection Vulnerabilities
glFusion is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
glFusion 1.1.2 and prior versions are vulnerable.
glFusion is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
glFusion 1.1.2 and prior versions are vulnerable.
Exploit / POC
glFusion Multiple SQL Injection Vulnerabilities
Attackers can use a browser to exploit these issues.
The following exploit is available:
Attackers can use a browser to exploit these issues.
The following exploit is available:
Solution / Fix
glFusion Multiple SQL Injection Vulnerabilities
Solution:
Vendor updates are available. Please contact the vendor for details.
glFusion glFusion 1.1.2
Solution:
Vendor updates are available. Please contact the vendor for details.
glFusion glFusion 1.1.2
-
glFusion private/system/classes/listfactory.class.php
http://www.glfusion.org/listfactory.class.zip
References
glFusion Multiple SQL Injection Vulnerabilities
References:
References: