Xataface WebAuction and Librarian DB Multiple Input Validation Vulnerabilities
BID:49544
Info
Xataface WebAuction and Librarian DB Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 49544 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 09 2011 12:00AM |
| Updated: | Sep 09 2011 12:00AM |
| Credit: | Antu Sanadi of SecPod Technologies. |
| Vulnerable: |
Xataface Web Auction 0.3.6 Xataface Web Auction 0.3.5 Xataface Librarian DB 0.2 Xataface Librarian DB 0.1.3 |
| Not Vulnerable: | |
Discussion
Xataface WebAuction and Librarian DB Multiple Input Validation Vulnerabilities
Xataface WebAuction and Librarian DB are prone to multiple input-validation vulnerabilities, including:
1. Multiple cross-site scripting vulnerabilities
2. An SQL-injection vulnerability
3. A local file-include vulnerability
Exploiting these issues could allow an attacker to execute arbitrary script code and PHP code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
WebAuction prior to 0.3.6 and Librarian DB prior to 0.2 are vulnerable. Other versions may also be affected.
Xataface WebAuction and Librarian DB are prone to multiple input-validation vulnerabilities, including:
1. Multiple cross-site scripting vulnerabilities
2. An SQL-injection vulnerability
3. A local file-include vulnerability
Exploiting these issues could allow an attacker to execute arbitrary script code and PHP code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
WebAuction prior to 0.3.6 and Librarian DB prior to 0.2 are vulnerable. Other versions may also be affected.
Exploit / POC
Xataface WebAuction and Librarian DB Multiple Input Validation Vulnerabilities
An attacker can exploit these issues through a browser. To exploit a cross-site scripting issue, the attacker must entice an unsuspecting victim to follow a malicious URI.
The following example URIs are available:
An attacker can exploit these issues through a browser. To exploit a cross-site scripting issue, the attacker must entice an unsuspecting victim to follow a malicious URI.
The following example URIs are available:
Solution / Fix
Xataface WebAuction and Librarian DB Multiple Input Validation Vulnerabilities
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
References
Xataface WebAuction and Librarian DB Multiple Input Validation Vulnerabilities
References:
References:
- Vendor Page (Xataface)
- Xataface WebAuction and Xataface Librarian DB Multiple Vulnerabilities (SecPod Technologies)