IBM Informix Web Datablade SQL Query HTML Decoding Vulnerability

Bugtraq ID:	4498
Class:	Input Validation Error
CVE:	CVE-2002-0555
Remote:	Yes
Local:	No
Published:	Apr 11 2002 12:00AM
Updated:	Jul 11 2009 11:56AM
Credit:	Discovered by Simon Lodal <[email protected]>.
Vulnerable:	IBM Informix Web Datablade 4.13 + IBM Informix SQL 9.2 0.UC2 + IBM Informix SQL 7.31 .UC5 IBM Informix Web Datablade 4.12 + IBM Informix SQL 9.2 0.UC2 + IBM Informix SQL 7.31 .UC5 IBM Informix Web Datablade 4.11 + IBM Informix SQL 9.2 0.UC2 + IBM Informix SQL 7.31 .UC5 IBM Informix Web Datablade 4.10 + IBM Informix SQL 9.2 0.UC2 + IBM Informix SQL 7.31 .UC5
Not Vulnerable:

IBM Informix Web Datablade SQL Query HTML Decoding Vulnerability

Informix is an enterprise database distributed and maintained by IBM. The Web Datablade Module for Informix SQL dynamically generates HTML content based on Database data. Web Datablade is available for Apache, IIS, and Netscape web servers, and a generic CGI version is provided for alternative servers. It will execute under Windows NT, Linux and many Unix-like systems.

Reportedly, SQL queries executed by Web Datablade decode HTML encoded input. If a developer were to use HTML encoding to sanitize user input, it would be possible to inadvertently create insecure applications.

IBM Informix Web Datablade SQL Query HTML Decoding Vulnerability

No exploit is required.

IBM Informix Web Datablade SQL Query HTML Decoding Vulnerability

Solution:
The vendor does not consider this to be a bug and as such, there is no fix available.

IBM Informix Web Datablade SQL Query HTML Decoding Vulnerability

References:

• IBM Informix Technical Support (IBM)