b2evolution Starrating Plugin Multiple SQL Injection Vulnerabilities
BID:34899
Info
b2evolution Starrating Plugin Multiple SQL Injection Vulnerabilities
| Bugtraq ID: | 34899 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 11 2009 12:00AM |
| Updated: | May 11 2009 05:36PM |
| Credit: | Reported by the vendor. |
| Vulnerable: |
b2evolution Plugins Starrating 0.7.6 |
| Not Vulnerable: |
b2evolution Plugins Starrating 0.7.7 |
Discussion
b2evolution Starrating Plugin Multiple SQL Injection Vulnerabilities
The Starrating plugin for b2evolution is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting these issues can allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
The issues affect versions prior to Starrating 0.7.7.
The Starrating plugin for b2evolution is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting these issues can allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
The issues affect versions prior to Starrating 0.7.7.
Exploit / POC
b2evolution Starrating Plugin Multiple SQL Injection Vulnerabilities
Attackers can use a browser to exploit these issues.
Attackers can use a browser to exploit these issues.
Solution / Fix
b2evolution Starrating Plugin Multiple SQL Injection Vulnerabilities
Solution:
The vendor has released fixes. Please see the references for details.
Solution:
The vendor has released fixes. Please see the references for details.
References
b2evolution Starrating Plugin Multiple SQL Injection Vulnerabilities
References:
References:
- Starrating 0.7.7 Release Notes (b2evolution Plugins)