ImpressCMS Unspecified SQL Injection Vulnerability
BID:44745
Info
ImpressCMS Unspecified SQL Injection Vulnerability
| Bugtraq ID: | 44745 |
| Class: | Input Validation Error |
| CVE: |
CVE-2010-4271 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 09 2010 12:00AM |
| Updated: | Apr 13 2015 09:02PM |
| Credit: | Reported by the vendor. |
| Vulnerable: |
ImpressCMS ImpressCMS 1.2.3 RC1 |
| Not Vulnerable: |
ImpressCMS ImpressCMS 1.2.3 RC2 |
Discussion
ImpressCMS Unspecified SQL Injection Vulnerability
ImpressCMS is prone to an unspecified SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Versions prior to ImpressCMS 1.2.3 RC2 are vulnerable.
ImpressCMS is prone to an unspecified SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Versions prior to ImpressCMS 1.2.3 RC2 are vulnerable.
Exploit / POC
ImpressCMS Unspecified SQL Injection Vulnerability
Attackers can use a browser to exploit this issue.
Attackers can use a browser to exploit this issue.
Solution / Fix
ImpressCMS Unspecified SQL Injection Vulnerability
Solution:
Vendor updates are available. Please see the references for more information.
Solution:
Vendor updates are available. Please see the references for more information.
References
ImpressCMS Unspecified SQL Injection Vulnerability
References:
References:
- ImpressCMS Homepage (ImpressCMS)
- ImpressCMS 1.2.3 RC2 (ImpressCMS)