KaiBB SQL Injection and Arbitrary File Upload Vulnerabilities
BID:49421
Info
KaiBB SQL Injection and Arbitrary File Upload Vulnerabilities
| Bugtraq ID: | 49421 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 02 2011 12:00AM |
| Updated: | Sep 02 2011 12:00AM |
| Credit: | KedAns-Dz |
| Vulnerable: |
KaiBB KaiBB 2.0.1 |
| Not Vulnerable: | |
Discussion
KaiBB SQL Injection and Arbitrary File Upload Vulnerabilities
KaiBB is prone to multiple SQL-injection vulnerabilities and a arbitrary-file-upload vulnerability because it fails to sanitize user-supplied data.
Exploiting these issues could allow an attacker to compromise the application, execute arbitrary code, access or modify data, or exploit latent vulnerabilities in the underlying database.
KaiBB 2.0.1 is vulnerable; other versions may also be affected.
KaiBB is prone to multiple SQL-injection vulnerabilities and a arbitrary-file-upload vulnerability because it fails to sanitize user-supplied data.
Exploiting these issues could allow an attacker to compromise the application, execute arbitrary code, access or modify data, or exploit latent vulnerabilities in the underlying database.
KaiBB 2.0.1 is vulnerable; other versions may also be affected.
Exploit / POC
KaiBB SQL Injection and Arbitrary File Upload Vulnerabilities
An attacker can use a browser to exploit these issues.
The following example data is available:
An attacker can use a browser to exploit these issues.
The following example data is available:
Solution / Fix
KaiBB SQL Injection and Arbitrary File Upload Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].