Samsung Integrated Management System DMS SQL Injection Vulnerability
BID:47746
Info
Samsung Integrated Management System DMS SQL Injection Vulnerability
| Bugtraq ID: | 47746 |
| Class: | Input Validation Error |
| CVE: |
CVE-2010-4284 |
| Remote: | Yes |
| Local: | No |
| Published: | May 06 2011 12:00AM |
| Updated: | May 06 2011 12:00AM |
| Credit: | José A. Guasch of SecurityByDefault.com |
| Vulnerable: |
Samsung Integrated Management System DMS 1.4.2 Samsung Integrated Management System DMS 1.4.1 Samsung Integrated Management System DMS 1.3.3 |
| Not Vulnerable: |
Samsung Integrated Management System DMS 1.4.3 |
Discussion
Samsung Integrated Management System DMS SQL Injection Vulnerability
Samsung Integrated Management System DMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Samsung Integrated Management System DMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Exploit / POC
Samsung Integrated Management System DMS SQL Injection Vulnerability
Attackers can use a browser to exploit this issue.
Attackers can use a browser to exploit this issue.
Solution / Fix
Samsung Integrated Management System DMS SQL Injection Vulnerability
Solution:
The vendor released an update. Please see the references for details.
Solution:
The vendor released an update. Please see the references for details.
References
Samsung Integrated Management System DMS SQL Injection Vulnerability
References:
References:
- Samsung Home Page (Samsung)
- Vulnerability Note VU#236668 (US-CERT)