Kunena SQL Injection and Information Disclosure Vulnerabilities
BID:46345
Info
Kunena SQL Injection and Information Disclosure Vulnerabilities
| Bugtraq ID: | 46345 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 11 2011 12:00AM |
| Updated: | Feb 11 2011 12:00AM |
| Credit: | Red Matter |
| Vulnerable: |
Kunena Team Kunena 1.6.2 Kunena Team Kunena 1.5.7 Kunena Team Kunena 1.5.6 Kunena Team Kunena 1.5.4 |
| Not Vulnerable: |
Kunena Team Kunena 1.6.3 Kunena Team Kunena 1.5.14 |
Discussion
Kunena SQL Injection and Information Disclosure Vulnerabilities
Kunena is prone to an SQL-injection vulnerability and an information-disclosure vulnerability.
Exploiting these issues could allow an attacker to obtain sensitive information, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Versions prior to Kunena 1.5.14 and 1.6.3 are vulnerable.
Kunena is prone to an SQL-injection vulnerability and an information-disclosure vulnerability.
Exploiting these issues could allow an attacker to obtain sensitive information, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Versions prior to Kunena 1.5.14 and 1.6.3 are vulnerable.
Exploit / POC
Kunena SQL Injection and Information Disclosure Vulnerabilities
Attackers can use a browser to exploit these issues.
Attackers can use a browser to exploit these issues.
Solution / Fix
Kunena SQL Injection and Information Disclosure Vulnerabilities
Solution:
Updates are available. Please see the reference for more details.
Solution:
Updates are available. Please see the reference for more details.
References
Kunena SQL Injection and Information Disclosure Vulnerabilities
References:
References:
- Kunena Homepage (Kunena)