iCRM Basic Joomla! Component Security Bypass and SQL Injection Vulnerabilities
BID:36533
Info
iCRM Basic Joomla! Component Security Bypass and SQL Injection Vulnerabilities
| Bugtraq ID: | 36533 |
| Class: | Input Validation Error |
| CVE: |
CVE-2009-3480 |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 28 2009 12:00AM |
| Updated: | Apr 13 2015 09:06PM |
| Credit: | kaMtiEz |
| Vulnerable: |
iCRM Basic iCRM Basic 1.4.2.31 |
| Not Vulnerable: | |
Discussion
iCRM Basic Joomla! Component Security Bypass and SQL Injection Vulnerabilities
iCRM Basic is prone to a security-bypass vulnerability and an SQL-injection vulnerability because it fails to adequately sanitize user-supplied input.
Exploiting the security-bypass issue may allow an attacker to bypass certain security restrictions and perform unauthorized actions. The attacker can exploit the SQL-injection issue by manipulating the SQL query logic to carry out unauthorized actions on the underlying database. This may compromise the application and may aid in further attacks.
iCRM Basic 1.4.2.31 is vulnerable; other versions may also be affected.
iCRM Basic is prone to a security-bypass vulnerability and an SQL-injection vulnerability because it fails to adequately sanitize user-supplied input.
Exploiting the security-bypass issue may allow an attacker to bypass certain security restrictions and perform unauthorized actions. The attacker can exploit the SQL-injection issue by manipulating the SQL query logic to carry out unauthorized actions on the underlying database. This may compromise the application and may aid in further attacks.
iCRM Basic 1.4.2.31 is vulnerable; other versions may also be affected.
Exploit / POC
iCRM Basic Joomla! Component Security Bypass and SQL Injection Vulnerabilities
Attackers can exploit these issues via a browser.
Attackers can exploit these issues via a browser.
Solution / Fix
iCRM Basic Joomla! Component Security Bypass and SQL Injection Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
iCRM Basic Joomla! Component Security Bypass and SQL Injection Vulnerabilities
References:
References:
- iCRM Basic Homepage (iCRM Basic)