GDL 'id' Parameter SQL Injection Vulnerability
BID:44786
Info
GDL 'id' Parameter SQL Injection Vulnerability
| Bugtraq ID: | 44786 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 11 2010 12:00AM |
| Updated: | Nov 11 2010 12:00AM |
| Credit: | Arianom |
| Vulnerable: |
Knowledge Management Research Group Otomigen.X 2.2 |
| Not Vulnerable: | |
Discussion
GDL 'id' Parameter SQL Injection Vulnerability
GDL (Ganesha Digital Library) is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
GDL 4.2 is vulnerable; other versions may also be affected.
GDL (Ganesha Digital Library) is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
GDL 4.2 is vulnerable; other versions may also be affected.
Exploit / POC
GDL 'id' Parameter SQL Injection Vulnerability
Attackers can use a browser to exploit this issue.
The following is sufficient to exploit this issue:
http://www.example.com/download.php?id=[SQL CODE]
Attackers can use a browser to exploit this issue.
The following is sufficient to exploit this issue:
http://www.example.com/download.php?id=[SQL CODE]
Solution / Fix
GDL 'id' Parameter SQL Injection Vulnerability
Solution:
Reports indicate that this issue has been fixed by the vendor but Symantec has not confirmed it. Please contact the vendor for more information.
Solution:
Reports indicate that this issue has been fixed by the vendor but Symantec has not confirmed it. Please contact the vendor for more information.
References
GDL 'id' Parameter SQL Injection Vulnerability
References:
References:
- GDL Homepage (knowledge management research group)