Family Connections 'fcms_login_id' Cookie Parameter SQL Injection Vulnerability

Bugtraq ID:	34367
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 03 2009 12:00AM
Updated:	May 26 2011 07:41PM
Credit:	Salvatore "drosophila" Fresta
Vulnerable:	Haudenschilt Family Connections 1.8.2 Haudenschilt Family Connections 1.8.1 Haudenschilt Family Connections 0.1.2 Haudenschilt Family Connections 0.1.1 Haudenschilt Family Connections 1.4 Haudenschilt Family Connections 0.9 Haudenschilt Family Connections 0.8 Haudenschilt Family Connections 0.6 Haudenschilt Family Connections 0.5
Not Vulnerable:	Haudenschilt Family Connections 2.3.2

Family Connections 'fcms_login_id' Cookie Parameter SQL Injection Vulnerability

Family Connections is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Family Connections 1.8.2 is vulnerable; other versions may also be affected.

Family Connections 'fcms_login_id' Cookie Parameter SQL Injection Vulnerability

An attacker can exploit this issue via a browser.

The following exploit code is available:

• /data/vulnerabilities/exploits/34367.c

Family Connections 'fcms_login_id' Cookie Parameter SQL Injection Vulnerability

Solution:
The vendor released an update. Please contact the vendor for details.

Family Connections 'fcms_login_id' Cookie Parameter SQL Injection Vulnerability

References:

• Family Connections Homepage (Family Connections)
  
• Family Connections 1.8.2 Blind SQL Injection (Correct Version) ("Salvatore \"drosophila\" Fresta" )