Website Baker Multiple Security Vulnerabilities
BID:41263
Info
Website Baker Multiple Security Vulnerabilities
| Bugtraq ID: | 41263 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 30 2010 12:00AM |
| Updated: | Jun 30 2010 12:00AM |
| Credit: | Secunia Research |
| Vulnerable: |
Website Baker Website Baker 2.8.2 Website Baker Website Baker 2.8.1 Revision 1287 Website Baker Website Baker 2.8 |
| Not Vulnerable: | |
Discussion
Website Baker Multiple Security Vulnerabilities
Website Baker is prone to multiple security vulnerabilities. These vulnerabilities include a cross-site scripting vulnerability, multiple HTML-injection vulnerabilities, multiple SQL-injection vulnerabilities, and multiple local file-include vulnerabilities.
An attacker can exploit these vulnerabilities to compromise the application, execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, perform unauthorized actions, exploit latent vulnerabilities in the underlying database, access or modify data, or execute arbitrary script code in the context of the webserver process. Other attacks are also possible.
Website Baker 2.8.1 Revision 1287 is vulnerable; other versions may also be affected.
Website Baker is prone to multiple security vulnerabilities. These vulnerabilities include a cross-site scripting vulnerability, multiple HTML-injection vulnerabilities, multiple SQL-injection vulnerabilities, and multiple local file-include vulnerabilities.
An attacker can exploit these vulnerabilities to compromise the application, execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, perform unauthorized actions, exploit latent vulnerabilities in the underlying database, access or modify data, or execute arbitrary script code in the context of the webserver process. Other attacks are also possible.
Website Baker 2.8.1 Revision 1287 is vulnerable; other versions may also be affected.
Exploit / POC
Website Baker Multiple Security Vulnerabilities
Attackers can exploit these issues via a browser.
Attackers can exploit these issues via a browser.
Solution / Fix
Website Baker Multiple Security Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Website Baker Multiple Security Vulnerabilities
References:
References:
- Secunia Research: Website Baker "username" Cross-Site Scripting Vulnerability (Secunia Research)
- Secunia Research: Website Baker Four Local File Inclusion Vulnerabilities (Secunia Research)
- Secunia Research: Website Baker Nine SQL Injection Vulnerabilities (Secunia Research)
- Secunia Research: Website Baker Two File Enumeration Vulnerabilities (Secunia Research)
- Secunia Research: Website Baker Two Script Insertion Vulnerabilities (Secunia Research)
- Website Baker Homepage (Website Baker)