MicroTopic 'rating' Parameter SQL Injection Vulnerability
BID:34907
Info
MicroTopic 'rating' Parameter SQL Injection Vulnerability
| Bugtraq ID: | 34907 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 11 2009 12:00AM |
| Updated: | May 11 2009 08:46PM |
| Credit: | YEnH4ckEr |
| Vulnerable: |
MicroTopic MicroTopic 1.00 |
| Not Vulnerable: |
MicroTopic MicroTopic 1.01 |
Discussion
MicroTopic 'rating' Parameter SQL Injection Vulnerability
MicroTopic is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue can allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Versions prior to MicroTopic 1.01 are vulnerable.
MicroTopic is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue can allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Versions prior to MicroTopic 1.01 are vulnerable.
Exploit / POC
MicroTopic 'rating' Parameter SQL Injection Vulnerability
Attackers can use a browser to exploit this issue.
The following exploit is available:
Attackers can use a browser to exploit this issue.
The following exploit is available:
Solution / Fix
MicroTopic 'rating' Parameter SQL Injection Vulnerability
Solution:
The vendor has released fixes. Please see the references for details.
Solution:
The vendor has released fixes. Please see the references for details.
References
MicroTopic 'rating' Parameter SQL Injection Vulnerability
References:
References: