urlShort Unspecified SQL Injection and Cross Site Scripting Vulnerabilities
BID:42355
Info
urlShort Unspecified SQL Injection and Cross Site Scripting Vulnerabilities
| Bugtraq ID: | 42355 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 26 2009 12:00AM |
| Updated: | Oct 26 2009 12:00AM |
| Credit: | urlShort |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
urlShort Unspecified SQL Injection and Cross Site Scripting Vulnerabilities
urlShort is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Versions prior to urlShort 1.2.0 are affected.
urlShort is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Versions prior to urlShort 1.2.0 are affected.
Exploit / POC
urlShort Unspecified SQL Injection and Cross Site Scripting Vulnerabilities
An attacker can exploit these issues via a browser. To exploit a cross-site scripting issue, the attacker must entice an unsuspecting victim to follow a malicious URI.
An attacker can exploit these issues via a browser. To exploit a cross-site scripting issue, the attacker must entice an unsuspecting victim to follow a malicious URI.
Solution / Fix
urlShort Unspecified SQL Injection and Cross Site Scripting Vulnerabilities
Solution:
The vendor has released fixes. Please see the references for details.
Solution:
The vendor has released fixes. Please see the references for details.
References
urlShort Unspecified SQL Injection and Cross Site Scripting Vulnerabilities
References:
References:
- Home page (urlShort)
- urlShort Update release notes (urlShort)