Aimluck Products Aipo and Aipo ASP Unspecified SQL Injection Vulnerability

Bugtraq ID:	49158
Class:	Input Validation Error
CVE:	CVE-2011-1342
Remote:	Yes
Local:	No
Published:	Aug 16 2011 12:00AM
Updated:	Mar 19 2015 09:24AM
Credit:	Tsuyoshi Yamaguchi of Digiplate, inc.
Vulnerable:	Aimluck Aipo ASP 5.1 1 Aimluck Aipo ASP 3.0.1 0 Aimluck Aipo 5.1 1 Aimluck Aipo 5.1 .1 Aimluck Aipo 5.0 .0 Aimluck Aipo 3.2 4 Aimluck Aipo 3.0.1 0 Aimluck Aipo 5.1 Aimluck Aipo 5.0.2.0 Aimluck Aipo 5.0.1.0 Aimluck Aipo 4.0.5.0 Aimluck Aipo 4.0.4.0 Aimluck Aipo 4.0.3.0 Aimluck Aipo 4.0.2.0 Aimluck Aipo 4.0.1.0
Not Vulnerable:	Aimluck Aipo ASP 5.1.1 Aimluck Aipo 5.1.1 8

Aimluck Products Aipo and Aipo ASP Unspecified SQL Injection Vulnerability

Aimluck products are prone to an unspecified SQL-injection vulnerability because they fail to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Versions prior to Aipo 5.1.1 and Aipo ASP 5.1.1 are vulnerable.

Aimluck Products Aipo and Aipo ASP Unspecified SQL Injection Vulnerability

Attackers can use a browser to exploit this issue.

Aimluck Products Aipo and Aipo ASP Unspecified SQL Injection Vulnerability

Solution:
Vendor updates are available. Please see the references for more information.

Aimluck Products Aipo and Aipo ASP Unspecified SQL Injection Vulnerability

References:

• Aipo / Aipo ASP Homepage (Aimluck)
  
• Aipo vulnerable to SQL injection (JPCERT/CC and IPA)
  
• JVNDB-2011-000063 (IPA)