Truworth Flex Timesheet Login Multiple SQL Injection Vulnerabilities
BID:43886
Info
Truworth Flex Timesheet Login Multiple SQL Injection Vulnerabilities
| Bugtraq ID: | 43886 |
| Class: | Input Validation Error |
| CVE: |
CVE-2010-4797 |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 08 2010 12:00AM |
| Updated: | Apr 13 2015 09:02PM |
| Credit: | KnocKout |
| Vulnerable: |
Truworth Flex Timesheet 0 |
| Not Vulnerable: | |
Discussion
Truworth Flex Timesheet Login Multiple SQL Injection Vulnerabilities
Truworth Flex Timesheet is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Truworth Flex Timesheet is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Exploit / POC
Truworth Flex Timesheet Login Multiple SQL Injection Vulnerabilities
Attackers can use a browser to exploit these issues.
The following example data is available:
Username: 'or'h4x0reSEC
Password: 'or'h4x0reSEC
Attackers can use a browser to exploit these issues.
The following example data is available:
Username: 'or'h4x0reSEC
Password: 'or'h4x0reSEC
Solution / Fix
Truworth Flex Timesheet Login Multiple SQL Injection Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Truworth Flex Timesheet Login Multiple SQL Injection Vulnerabilities
References:
References:
- Truworth Flex Timesheet Product Page (Truworth)