JAKCMS 'admin/index.php' Multiple SQL Injection Vulnerabilities
BID:46447
Info
JAKCMS 'admin/index.php' Multiple SQL Injection Vulnerabilities
| Bugtraq ID: | 46447 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 18 2011 12:00AM |
| Updated: | Feb 21 2011 07:29AM |
| Credit: | Steven Seeley, stratsec |
| Vulnerable: |
JAKCMS JAKCMS 2.0 PRO RC5 0 JAKCMS JAKCMS 2.0.2 JAKCMS JAKCMS 2.0 |
| Not Vulnerable: |
JAKCMS JAKCMS 2.0.3 |
Discussion
JAKCMS 'admin/index.php' Multiple SQL Injection Vulnerabilities
JAKCMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
JAKCMS 2.0.2 is vulnerable; other versions may also be affected.
JAKCMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
JAKCMS 2.0.2 is vulnerable; other versions may also be affected.
Exploit / POC
JAKCMS 'admin/index.php' Multiple SQL Injection Vulnerabilities
Attackers can use a browser to exploit these issues.
The following exploit codes are available:
Attackers can use a browser to exploit these issues.
The following exploit codes are available:
Solution / Fix
JAKCMS 'admin/index.php' Multiple SQL Injection Vulnerabilities
Solution:
Updates are available. Please see the references for more information.
Solution:
Updates are available. Please see the references for more information.
References
JAKCMS 'admin/index.php' Multiple SQL Injection Vulnerabilities
References:
References:
- JACMS Homepage (JAKCMS)
- JAKCMS PRO 2.0.3 (JAKCMS)
- JAKCMS SQL Injection (SS-2011-002) (JAKCMS)