Ariadne WCM Username Enumeration Weakness and SQL Injection Vulnerabilities
BID:45654
Info
Ariadne WCM Username Enumeration Weakness and SQL Injection Vulnerabilities
| Bugtraq ID: | 45654 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 01 2011 12:00AM |
| Updated: | Jan 01 2011 12:00AM |
| Credit: | Andrea Purificato |
| Vulnerable: |
Ariadne Content Manager Ariadne WCM 4.4 |
| Not Vulnerable: |
Ariadne Content Manager Ariadne WCM 4.5 |
Discussion
Ariadne WCM Username Enumeration Weakness and SQL Injection Vulnerabilities
Ariadne WCM is prone to username-enumeration weakness and an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Attackers may exploit this weakness to discern valid usernames, which may aid them in brute-force password cracking or other attacks.
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Ariadne WCM 4.4 is vulnerable; other versions may also be affected.
Ariadne WCM is prone to username-enumeration weakness and an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Attackers may exploit this weakness to discern valid usernames, which may aid them in brute-force password cracking or other attacks.
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Ariadne WCM 4.4 is vulnerable; other versions may also be affected.
Solution / Fix
Ariadne WCM Username Enumeration Weakness and SQL Injection Vulnerabilities
Solution:
Updates are available. Please see the references for details.
Solution:
Updates are available. Please see the references for details.