Q2 Solutions ConnX 'frmLoginPwdReminderPopup.aspx' SQL Injection Vulnerability
BID:34350
Info
Q2 Solutions ConnX 'frmLoginPwdReminderPopup.aspx' SQL Injection Vulnerability
| Bugtraq ID: | 34350 |
| Class: | Input Validation Error |
| CVE: |
CVE-2009-4947 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 02 2009 12:00AM |
| Updated: | Apr 13 2015 09:11PM |
| Credit: | Patrick Webster |
| Vulnerable: |
Q2 Solutions ConnX 4.0.20080606 |
| Not Vulnerable: |
Q2 Solutions ConnX 4.1 |
Discussion
Q2 Solutions ConnX 'frmLoginPwdReminderPopup.aspx' SQL Injection Vulnerability
Q2 Solutions ConnX is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
ConnX 4.0.20080606 is vulnerable; other versions may also be affected.
Q2 Solutions ConnX is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
ConnX 4.0.20080606 is vulnerable; other versions may also be affected.
Exploit / POC
Q2 Solutions ConnX 'frmLoginPwdReminderPopup.aspx' SQL Injection Vulnerability
Attackers can use a browser to exploit this issue.
Attackers can use a browser to exploit this issue.
Solution / Fix
Q2 Solutions ConnX 'frmLoginPwdReminderPopup.aspx' SQL Injection Vulnerability
Solution:
The vendor has released updates. Please contact the vendor for more information.
Solution:
The vendor has released updates. Please contact the vendor for more information.
References
Q2 Solutions ConnX 'frmLoginPwdReminderPopup.aspx' SQL Injection Vulnerability
References:
References:
- Vendor Homepage (Q2 Solutions)
- Q2 Solutions ConnX - SQL Injection Vulnerability (Patrick Webster