OCS Inventory NG Cross Site Scripting and SQL Injection Vulnerabilities

Bugtraq ID:	38131
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 26 2010 12:00AM
Updated:	Feb 08 2010 05:01PM
Credit:	Hernan Jais
Vulnerable:	Red Hat Fedora 12 Red Hat Fedora 11 OCS Inventory Team OCS Inventory NG Server 1.2.1
Not Vulnerable:

OCS Inventory NG Cross Site Scripting and SQL Injection Vulnerabilities

OCS Inventory NG is prone to multiple SQL-injection vulnerabilities and a cross-site scripting vulnerability.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

OCS Inventory NG 1.02.1 is vulnerable; other versions may also be affected.

OCS Inventory NG Cross Site Scripting and SQL Injection Vulnerabilities

An attacker can exploit these issues via a browser. To exploit a cross-site scripting issue, the attacker must entice an unsuspecting victim to follow a malicious URI.

OCS Inventory NG Cross Site Scripting and SQL Injection Vulnerabilities

Solution:
Updates are available. Please see the references for more information.

OCS Inventory NG Cross Site Scripting and SQL Injection Vulnerabilities

References:

• OCS Inventory NG Homepage (OCS Inventory Team)