OSSIM SQL Injection, Cross Site Scripting and Unauthorized Access Vulnerabilities
BID:36504
Info
OSSIM SQL Injection, Cross Site Scripting and Unauthorized Access Vulnerabilities
| Bugtraq ID: | 36504 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 23 2009 12:00AM |
| Updated: | Sep 24 2009 04:20PM |
| Credit: | Sintsov Alexey of Digital Security Research Group |
| Vulnerable: |
OSSIM os-sim 2.1.1 OSSIM os-sim 2.1 |
| Not Vulnerable: |
OSSIM os-sim 2.1.2 |
Discussion
OSSIM SQL Injection, Cross Site Scripting and Unauthorized Access Vulnerabilities
OSSIM is prone to multiple input-validation vulnerabilities, including SQL-injection issues, a cross-site scripting issue, and unauthorized-access issues.
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Versions prior to OSSIM 2.1.2 are affected.
OSSIM is prone to multiple input-validation vulnerabilities, including SQL-injection issues, a cross-site scripting issue, and unauthorized-access issues.
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Versions prior to OSSIM 2.1.2 are affected.
Exploit / POC
OSSIM SQL Injection, Cross Site Scripting and Unauthorized Access Vulnerabilities
An attacker can exploit these issues via a browser. To exploit a cross-site scripting issue, the attacker must entice an unsuspecting victim to follow a malicious URI.
The following example URIs are available:
An attacker can exploit these issues via a browser. To exploit a cross-site scripting issue, the attacker must entice an unsuspecting victim to follow a malicious URI.
The following example URIs are available:
Solution / Fix
OSSIM SQL Injection, Cross Site Scripting and Unauthorized Access Vulnerabilities
Solution:
Updates are available. Please see the references for details.
Solution:
Updates are available. Please see the references for details.
References
OSSIM SQL Injection, Cross Site Scripting and Unauthorized Access Vulnerabilities
References:
References: