Achievo Multiple Input Validation Vulnerabilities
BID:47010
Info
Achievo Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 47010 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 23 2011 12:00AM |
| Updated: | Mar 23 2011 12:00AM |
| Credit: | Secunia Research |
| Vulnerable: |
Achievo Achievo 1.4.3 Achievo Achievo 1.4.2 Achievo Achievo 1.4 Achievo Achievo 1.3.4 Achievo Achievo 1.3.2 Achievo Achievo 1.2.1 Achievo Achievo 1.1 Achievo Achievo 1.4.5 Achievo Achievo 1.2 |
| Not Vulnerable: | |
Discussion
Achievo Multiple Input Validation Vulnerabilities
Achievo is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied data. These issues include:
1. Multiple cross-site scripting vulnerabilities.
2. Multiple SQL-injection vulnerabilities.
3. A security-bypass vulnerability.
4. Multiple local file-include vulnerabilities.
Exploiting these issues could allow the attacker to execute arbitrary local files, obtain sensitive information, steal cookie-based authentication credentials, compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, and bypass certain security restrictions to perform unauthorized actions.
Achievo is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied data. These issues include:
1. Multiple cross-site scripting vulnerabilities.
2. Multiple SQL-injection vulnerabilities.
3. A security-bypass vulnerability.
4. Multiple local file-include vulnerabilities.
Exploiting these issues could allow the attacker to execute arbitrary local files, obtain sensitive information, steal cookie-based authentication credentials, compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, and bypass certain security restrictions to perform unauthorized actions.
Exploit / POC
Achievo Multiple Input Validation Vulnerabilities
An attacker can exploit some of these issues with a browser. To exploit a cross-site scripting issue, the attacker must entice an unsuspecting victim to follow a malicious URI.
An attacker can exploit some of these issues with a browser. To exploit a cross-site scripting issue, the attacker must entice an unsuspecting victim to follow a malicious URI.
Solution / Fix
Achievo Multiple Input Validation Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Achievo Multiple Input Validation Vulnerabilities
References:
References:
- Achievo Homepage (Achievo)
- Secunia Research: Achievo "owner" Scheduler Security Bypass Vulnerability (Secunia Research)
- Secunia Research: Achievo Six SQL Injection Vulnerabilities (Secunia Research)
- Secunia Research: Achievo Three Cross-Site Scripting Vulnerabilities (Secunia Research)
- Secunia Research: Achievo Two Local File Inclusion Vulnerabilities (Secunia Research)