TheHostingTool 'class_db.php' Multiple SQL Injection Vulnerabilities
BID:45560
Info
TheHostingTool 'class_db.php' Multiple SQL Injection Vulnerabilities
| Bugtraq ID: | 45560 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 23 2010 12:00AM |
| Updated: | Dec 23 2010 12:00AM |
| Credit: | Russ McRee via Secunia. |
| Vulnerable: |
TheHostingTool TheHostingTool 1.2.2 |
| Not Vulnerable: |
TheHostingTool TheHostingTool 1.2.3 |
Discussion
TheHostingTool 'class_db.php' Multiple SQL Injection Vulnerabilities
TheHostingTool is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
TheHostingTool 1.2.2 is affected; other versions may also be vulnerable.
TheHostingTool is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
TheHostingTool 1.2.2 is affected; other versions may also be vulnerable.
Exploit / POC
TheHostingTool 'class_db.php' Multiple SQL Injection Vulnerabilities
Attackers can use a browser to exploit these issues.
Attackers can use a browser to exploit these issues.
Solution / Fix
TheHostingTool 'class_db.php' Multiple SQL Injection Vulnerabilities
Solution:
Updates are available. Please see the references for more information.
Solution:
Updates are available. Please see the references for more information.
References
TheHostingTool 'class_db.php' Multiple SQL Injection Vulnerabilities
References:
References:
- Product Homepage (TheHostingTool)
- TheHostingTool v1.2.3 (TheHostingTool)
- TheHostingTool v1.2.3.diff (TheHostingTool)