PHPMyFamily Multiple Remote Vulnerabilities
BID:43293
Info
PHPMyFamily Multiple Remote Vulnerabilities
| Bugtraq ID: | 43293 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 17 2010 12:00AM |
| Updated: | Sep 20 2010 06:11AM |
| Credit: | Abysssec |
| Vulnerable: |
phpmyfamily phpmyfamily 1.4.1 phpmyfamily phpmyfamily 1.4 phpmyfamily phpmyfamily 1.4.2 |
| Not Vulnerable: | |
Discussion
PHPMyFamily Multiple Remote Vulnerabilities
PHPMyFamily is prone to multiple remote vulnerabilities:
- Multiple information-disclosure vulnerabilities
- Multiple SQL-injection vulnerabilities
- Multiple cross-site scripting vulnerabilities
- A security-bypass vulnerability
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, obtain sensitive information, bypass certain security restrictions, access or modify data, or exploit latent vulnerabilities in the underlying database.
PHPMyFamily 1.42 and prior are vulnerable.
PHPMyFamily is prone to multiple remote vulnerabilities:
- Multiple information-disclosure vulnerabilities
- Multiple SQL-injection vulnerabilities
- Multiple cross-site scripting vulnerabilities
- A security-bypass vulnerability
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, obtain sensitive information, bypass certain security restrictions, access or modify data, or exploit latent vulnerabilities in the underlying database.
PHPMyFamily 1.42 and prior are vulnerable.
Exploit / POC
PHPMyFamily Multiple Remote Vulnerabilities
Attackers can use a browser to exploit these issues. For a cross-site scripting issue, an unsuspecting user must be enticed into following a malicious link.
The following example URIs and data are available:
Attackers can use a browser to exploit these issues. For a cross-site scripting issue, an unsuspecting user must be enticed into following a malicious link.
The following example URIs and data are available:
Solution / Fix
PHPMyFamily Multiple Remote Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].