Danneo CMS Multiple SQL Injection Vulnerabilities
BID:44230
Info
Danneo CMS Multiple SQL Injection Vulnerabilities
| Bugtraq ID: | 44230 |
| Class: | Input Validation Error |
| CVE: |
CVE-2009-3118 |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 31 2009 12:00AM |
| Updated: | Aug 31 2009 12:00AM |
| Credit: | Inj3ct0r |
| Vulnerable: |
CMS Danneo Danneo CMS 0.5.2 |
| Not Vulnerable: | |
Discussion
Danneo CMS Multiple SQL Injection Vulnerabilities
Danneo CMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Danneo CMS 0.5.2 and prior are vulnerable.
Danneo CMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Danneo CMS 0.5.2 and prior are vulnerable.
Exploit / POC
Danneo CMS Multiple SQL Injection Vulnerabilities
Attackers can use a browser to exploit these issues.
Attackers can use a browser to exploit these issues.
Solution / Fix
Danneo CMS Multiple SQL Injection Vulnerabilities
Solution:
Updates are available. Please see the references for more information.
Solution:
Updates are available. Please see the references for more information.