RETIRED: AWCM CMS 'username' Parameter Multiple SQL Injection Vulnerabilities

Bugtraq ID:	44930
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 18 2010 12:00AM
Updated:	Apr 06 2011 02:55PM
Credit:	eidelweiss
Vulnerable:	AWCM AWCM CMS 2.2
Not Vulnerable:

RETIRED: AWCM CMS 'username' Parameter Multiple SQL Injection Vulnerabilities

AWCM CMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

A successful exploit can allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

AWCM CMS 2.2 is vulnerable; other versions may also be affected.

This BID is being retired as a duplicate of BID 43441 (AWCM Multiple Input Validation Vulnerabilities).

RETIRED: AWCM CMS 'username' Parameter Multiple SQL Injection Vulnerabilities

Attackers can use a browser to exploit these issues.

The following example input is available:

username : 'or 1=1/*

RETIRED: AWCM CMS 'username' Parameter Multiple SQL Injection Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

RETIRED: AWCM CMS 'username' Parameter Multiple SQL Injection Vulnerabilities

References:

• Product Homepage (AWCM)
  
• Re: AWCM v2.2 Auth Bypass Vulnerabilities (security curmudgeon )