XOOPS 'include/notification_update.php' SQL Injection Vulnerability

Bugtraq ID:	37597
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 04 2010 12:00AM
Updated:	Jan 04 2010 12:00AM
Credit:	Stefano Angaran (trabis)
Vulnerable:	Xoops Xoops 2.4.2 Xoops Xoops 2.4.1 Xoops Xoops 2.4.1 Xoops Xoops 2.4 Xoops Xoops 2.3.3 Xoops Xoops 2.3.2 b Xoops Xoops 2.3.2 Xoops Xoops 2.2.5 Xoops Xoops 2.2.3 RC1 Xoops Xoops 2.2.3 Xoops Xoops 2.2.1 Xoops Xoops 2.0.18 .1 Xoops Xoops 2.0.18 Xoops Xoops 2.0.17 1 Xoops Xoops 2.0.15 Xoops Xoops 2.0.14 Xoops Xoops 2.0.13 .2 Xoops Xoops 2.0.13 .1 Xoops Xoops 2.0.12 a Xoops Xoops 2.0.12 Xoops Xoops 2.0.11 Xoops Xoops 2.0.10 Xoops Xoops 2.0.9 .3 Xoops Xoops 2.0.9 .2 Xoops Xoops 2.0.5 .2 Xoops Xoops 2.0.5 .1 Xoops Xoops 2.0.5 Xoops Xoops 2.0.3 Xoops Xoops 2.0.2 Xoops Xoops 2.0.1 Xoops Xoops 2.0 Xoops Xoops 1.3.10 Xoops Xoops 1.3.9 Xoops Xoops 1.3.8 Xoops Xoops 1.3.7 Xoops Xoops 1.3.6 Xoops Xoops 1.3.5 Xoops Xoops 1.0 RC1 Xoops Xoops 1.0 RC3.0.5 Xoops Xoops 1.0 RC3 Xoops Xoops 2.3 Xoops Xoops 2.0.16 core Xoops Xoops 1.0
Not Vulnerable:	Xoops Xoops 2.4.3

XOOPS 'include/notification_update.php' SQL Injection Vulnerability

XOOPS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Versions prior to XOOPS 2.4.3 are affected.

XOOPS 'include/notification_update.php' SQL Injection Vulnerability

Attackers can use a browser to exploit this issue.

XOOPS 'include/notification_update.php' SQL Injection Vulnerability

Solution:
Updates are available. Please see the references for details.

XOOPS 'include/notification_update.php' SQL Injection Vulnerability

References:

• XOOPS 2.4.3 FINAL Is Released (Xoops)
  
• XOOPS Homepage (XOOPS)