EgyPlus 7ml Multiple Input Validation Vulnerabilities
BID:44411
Info
EgyPlus 7ml Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 44411 |
| Class: | Input Validation Error |
| CVE: |
CVE-2009-2167 CVE-2009-2168 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 03 2009 12:00AM |
| Updated: | Oct 26 2010 03:18PM |
| Credit: | Qabandi |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
EgyPlus 7ml Multiple Input Validation Vulnerabilities
EgyPlus 7ml is prone to multiple SQL-injection and authentication-bypass vulnerabilities because it fails to sufficiently sanitize user-supplied data.
Attackers can exploit these issues to to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. In addition, a successful exploit can allow the attacker to bypass checks for administrative users, allowing access to administrative functions. Other attacks may also be possible.
EgyPlus 7ml 1.0.1 is vulnerable; other versions may also be affected.
EgyPlus 7ml is prone to multiple SQL-injection and authentication-bypass vulnerabilities because it fails to sufficiently sanitize user-supplied data.
Attackers can exploit these issues to to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. In addition, a successful exploit can allow the attacker to bypass checks for administrative users, allowing access to administrative functions. Other attacks may also be possible.
EgyPlus 7ml 1.0.1 is vulnerable; other versions may also be affected.
Exploit / POC
EgyPlus 7ml Multiple Input Validation Vulnerabilities
Attackers can use a browser to exploit these issues.
The following input data are available:
username: qabandi' or '1'='1
password: qabandi' or '1'='1
javascript:document.cookie = "username=qabandi' or '1'='1"
javascript:document.cookie = "password=qabandi' or '1'='1"
Attackers can use a browser to exploit these issues.
The following input data are available:
username: qabandi' or '1'='1
password: qabandi' or '1'='1
javascript:document.cookie = "username=qabandi' or '1'='1"
javascript:document.cookie = "password=qabandi' or '1'='1"
Solution / Fix
EgyPlus 7ml Multiple Input Validation Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].