Webmatic Multiple Unspecified SQL Injection and Cross-Site Scripting Vulnerabilities
BID:37335
Info
Webmatic Multiple Unspecified SQL Injection and Cross-Site Scripting Vulnerabilities
| Bugtraq ID: | 37335 |
| Class: | Input Validation Error |
| CVE: |
CVE-2009-4379 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 14 2009 12:00AM |
| Updated: | Apr 13 2015 09:05PM |
| Credit: | The vendor reported these issues. |
| Vulnerable: |
Valarsoft WebMatic 3.0.2 |
| Not Vulnerable: |
Valarsoft WebMatic 3.0.3 |
Discussion
Webmatic Multiple Unspecified SQL Injection and Cross-Site Scripting Vulnerabilities
Webmatic is prone to multiple cross-site scripting and SQL-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied input.
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Versions prior to Webmatic 3.0.3 are vulnerable.
Webmatic is prone to multiple cross-site scripting and SQL-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied input.
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Versions prior to Webmatic 3.0.3 are vulnerable.
Exploit / POC
Webmatic Multiple Unspecified SQL Injection and Cross-Site Scripting Vulnerabilities
An attacker can exploit these issues via a browser. To exploit a cross-site scripting vulnerability, the attacker must entice a victim into following a malicious URI.
An attacker can exploit these issues via a browser. To exploit a cross-site scripting vulnerability, the attacker must entice a victim into following a malicious URI.
Solution / Fix
Webmatic Multiple Unspecified SQL Injection and Cross-Site Scripting Vulnerabilities
Solution:
The vendor has released updates. Please see the references for details.
Valarsoft WebMatic 3.0.2
Solution:
The vendor has released updates. Please see the references for details.
Valarsoft WebMatic 3.0.2
-
Valarsoft webmatic_303.zip
http://www.valarsoft.com/data/downloads/webmatic_303.zip
References
Webmatic Multiple Unspecified SQL Injection and Cross-Site Scripting Vulnerabilities
References:
References:
- Webmatic Homepage (Valarsoft)
- Webmatic 3.0.3 released (Valarsoft)