GForge SQL Injection and Cross Site Scripting Vulnerabilities
BID:35424
Info
GForge SQL Injection and Cross Site Scripting Vulnerabilities
| Bugtraq ID: | 35424 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 18 2009 12:00AM |
| Updated: | Jun 22 2009 05:39PM |
| Credit: | Laurent Almeras and Guillaume Smet |
| Vulnerable: |
GForge GForge 4.5.14 GForge GForge 4.7rc2 |
| Not Vulnerable: | |
Discussion
GForge SQL Injection and Cross Site Scripting Vulnerabilities
GForge is prone to multiple SQL-injection and cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
GForge 4.5.14 and 4.7rc2 are affected; other versions may be affected as well.
GForge is prone to multiple SQL-injection and cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
GForge 4.5.14 and 4.7rc2 are affected; other versions may be affected as well.
Exploit / POC
GForge SQL Injection and Cross Site Scripting Vulnerabilities
An attacker can exploit these issues via a browser. To exploit a cross-site scripting issue, the attacker must entice an unsuspecting victim to follow a malicious URI.
An attacker can exploit these issues via a browser. To exploit a cross-site scripting issue, the attacker must entice an unsuspecting victim to follow a malicious URI.
Solution / Fix
GForge SQL Injection and Cross Site Scripting Vulnerabilities
Solution:
Vendor fixes are available. Please see the references for details.
Solution:
Vendor fixes are available. Please see the references for details.