Gowon Designs Leap Multiple Input Validation Vulnerabilities
BID:34787
Info
Gowon Designs Leap Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 34787 |
| Class: | Input Validation Error |
| CVE: |
CVE-2009-1613 CVE-2009-1614 CVE-2009-1615 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 30 2009 12:00AM |
| Updated: | May 21 2009 05:20AM |
| Credit: | YEnH4ckEr |
| Vulnerable: |
Gowon Designs Leap 0.1.4 |
| Not Vulnerable: | |
Discussion
Gowon Designs Leap Multiple Input Validation Vulnerabilities
Gowon Designs Leap is prone to multiple security vulnerabilities because the application fails to properly sanitize user-supplied input.
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, execute arbitrary script code in the context of the webserver process, compromise the application, obtain sensitive information, access or modify data, or exploit latent vulnerabilities in the underlying database.
Leap 0.1.4 is vulnerable; other versions may also be affected.
Gowon Designs Leap is prone to multiple security vulnerabilities because the application fails to properly sanitize user-supplied input.
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, execute arbitrary script code in the context of the webserver process, compromise the application, obtain sensitive information, access or modify data, or exploit latent vulnerabilities in the underlying database.
Leap 0.1.4 is vulnerable; other versions may also be affected.
Exploit / POC
Gowon Designs Leap Multiple Input Validation Vulnerabilities
An attacker can use a browser to exploit these issues. To exploit a cross-site scripting issue, the attacker must entice an unsuspecting user into following a malicious URI.
The following example data is available:
Email Address: nothing' or 1=1#
Password: nothing
The following exploit code is available:
An attacker can use a browser to exploit these issues. To exploit a cross-site scripting issue, the attacker must entice an unsuspecting user into following a malicious URI.
The following example data is available:
Email Address: nothing' or 1=1#
Password: nothing
The following exploit code is available:
Solution / Fix
Gowon Designs Leap Multiple Input Validation Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Gowon Designs Leap Multiple Input Validation Vulnerabilities
References:
References: