Sahana Agasti Multiple Input Validation Vulnerabilities
BID:45730
Info
Sahana Agasti Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 45730 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 08 2011 12:00AM |
| Updated: | Jan 20 2011 06:01PM |
| Credit: | dun, Mark Prutsalis |
| Vulnerable: |
Sahana Agasti 0.6.5 Sahana Agasti 0.6.4 |
| Not Vulnerable: |
Sahana Agasti 0.6.6 |
Discussion
Sahana Agasti Multiple Input Validation Vulnerabilities
Sahana Agasti is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied data.
An attacker can exploit these vulnerabilities to obtain potentially sensitive information and to execute arbitrary local scripts in the context of the webserver process, which may aid in redirecting users to a potentially malicious site. This may allow the attacker to compromise the application and the computer and may aid in phishing attacks; other attacks are also possible.
Sahana Agasti versions 0.6.5 and prior are vulnerable.
Sahana Agasti is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied data.
An attacker can exploit these vulnerabilities to obtain potentially sensitive information and to execute arbitrary local scripts in the context of the webserver process, which may aid in redirecting users to a potentially malicious site. This may allow the attacker to compromise the application and the computer and may aid in phishing attacks; other attacks are also possible.
Sahana Agasti versions 0.6.5 and prior are vulnerable.
Exploit / POC
Sahana Agasti Multiple Input Validation Vulnerabilities
The following exploit code is available:
The following exploit code is available:
Solution / Fix
References
Sahana Agasti Multiple Input Validation Vulnerabilities
References:
References:
- Sahana Agasti 0.6.6 Released (Sahana Software)
- Sahana Agasti Reference Page (Sahana)
- Sahana Homepage (Sahana)