MediaCast Multiple Input Validation Vulnerabilities
BID:47833
Info
MediaCast Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 47833 |
| Class: | Input Validation Error |
| CVE: |
CVE-2011-2078 CVE-2011-2079 CVE-2011-2080 CVE-2011-2081 |
| Remote: | Yes |
| Local: | No |
| Published: | May 12 2011 12:00AM |
| Updated: | May 12 2011 12:00AM |
| Credit: | Daniel Clemens and Packetninjas. |
| Vulnerable: |
Inventive Technology MediaCast 8 |
| Not Vulnerable: | |
Discussion
MediaCast Multiple Input Validation Vulnerabilities
MediaCast is prone to an information-disclosure vulnerability, multiple SQL-injection vulnerabilities, multiple cross-site scripting vulnerabilities, and multiple XML-injection vulnerabilities.
Exploiting these issues could allow an attacker to compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, gain access to sensitive information, control how the site is rendered to the user, or execute arbitrary XML and script code in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials.
MediaCast 8 is vulnerable; other versions may also be affected.
MediaCast is prone to an information-disclosure vulnerability, multiple SQL-injection vulnerabilities, multiple cross-site scripting vulnerabilities, and multiple XML-injection vulnerabilities.
Exploiting these issues could allow an attacker to compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, gain access to sensitive information, control how the site is rendered to the user, or execute arbitrary XML and script code in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials.
MediaCast 8 is vulnerable; other versions may also be affected.
Exploit / POC
MediaCast Multiple Input Validation Vulnerabilities
Attackers can use a browser to exploit these issues. To exploit the cross-site scripting issues an attacker must entice an unsuspecting victim to follow a malicious URI.
Attackers can use a browser to exploit these issues. To exploit the cross-site scripting issues an attacker must entice an unsuspecting victim to follow a malicious URI.
Solution / Fix
MediaCast Multiple Input Validation Vulnerabilities
Solution:
Vendor updates are available. Please see the references for details.
Solution:
Vendor updates are available. Please see the references for details.
References
MediaCast Multiple Input Validation Vulnerabilities
References:
References:
- MediaCast Homepage (Inventive Technology)
- MediaCast Password Dump Vulnerability ( Daniel Clemens)