FrontAccounting Multiple SQL Injection Vulnerabilities
BID:44558
Info
FrontAccounting Multiple SQL Injection Vulnerabilities
| Bugtraq ID: | 44558 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 29 2010 12:00AM |
| Updated: | Oct 29 2010 12:00AM |
| Credit: | Juan Manuel Garcia |
| Vulnerable: |
FrontAccounting FrontAccounting 2.3 RC2 |
| Not Vulnerable: |
FrontAccounting FrontAccounting 2.3 RC3 |
Discussion
FrontAccounting Multiple SQL Injection Vulnerabilities
FrontAccounting is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
FrontAccounting 2.3 RC2 is vulnerable; other versions may also be affected.
FrontAccounting is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
FrontAccounting 2.3 RC2 is vulnerable; other versions may also be affected.
Exploit / POC
FrontAccounting Multiple SQL Injection Vulnerabilities
Attackers can use a browser to exploit these issues.
Attackers can use a browser to exploit these issues.
Solution / Fix
FrontAccounting Multiple SQL Injection Vulnerabilities
Solution:
Vendor updates are available. Please see the references for more information.
Solution:
Vendor updates are available. Please see the references for more information.
References
FrontAccounting Multiple SQL Injection Vulnerabilities
References:
References:
- CYBSEC Advisory 2010 1003 Multiple SQL Injections in Front Accounting (Juan Manuel Garcia)
- Release 2.3 RC3 (FrontAccounting)