Symphony 'token' Parameter SQL Injection Vulnerability
BID:47592
Info
Symphony 'token' Parameter SQL Injection Vulnerability
| Bugtraq ID: | 47592 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 27 2011 12:00AM |
| Updated: | Apr 27 2011 12:00AM |
| Credit: | Wireghoul |
| Vulnerable: |
Symphony Symphony 2.1.2 |
| Not Vulnerable: |
Symphony Symphony 2.2 |
Discussion
Symphony 'token' Parameter SQL Injection Vulnerability
Symphony is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Symphony 2.1.2 is vulnerable; other versions may also be affected.
Symphony is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Symphony 2.1.2 is vulnerable; other versions may also be affected.
Exploit / POC
Symphony 'token' Parameter SQL Injection Vulnerability
Attackers can use a browser to exploit this issue.
The following example URI is available:
http://www.example.com/symphony/login/?action=resetpass&token=-1'+union+select+id,'[email protected]',username+from+tbl_authors+where+id+=1+--+
Attackers can use a browser to exploit this issue.
The following example URI is available:
http://www.example.com/symphony/login/?action=resetpass&token=-1'+union+select+id,'[email protected]',username+from+tbl_authors+where+id+=1+--+
Solution / Fix
Symphony 'token' Parameter SQL Injection Vulnerability
Solution:
Reportedly, the vendor has fixed the issue; however, Symantec has not confirmed it. Please contact the vendor for more information.
Solution:
Reportedly, the vendor has fixed the issue; however, Symantec has not confirmed it. Please contact the vendor for more information.