Voxel Dot Net CBMS Multiple Code Injection Vulnerabilities

Bugtraq ID:	4957
Class:	Input Validation Error
CVE:	CVE-2002-0960 CVE-2002-0961
Remote:	Yes
Local:	No
Published:	Jun 06 2002 12:00AM
Updated:	Jul 11 2009 01:56PM
Credit:	Reported by Ulf Harnhammar <[email protected]>.
Vulnerable:	Voxel Dot Net CBMS 0.7 Voxel Dot Net CBMS 0.6.2 Voxel Dot Net CBMS 0.6.1 Voxel Dot Net CBMS 0.6 Voxel Dot Net CBMS 0.5 Voxel Dot Net CBMS 0.4 Voxel Dot Net CBMS 0.3 Voxel Dot Net CBMS 0.2 Voxel Dot Net CBMS 0.1
Not Vulnerable:

Voxel Dot Net CBMS Multiple Code Injection Vulnerabilities

It has been reported that multiple vulnerabilities exist in CBMS. Reportedly, it is possible to inject both JavaScript and SQL code into the system. It may be possible to execute script code within the context of the site as an authenticated administrator, or to view or modify sensitive database information through the subversion of an SQL query.

These issues have been reported in version 0.7 of CBMS. Other versions may share these vulnerabilities, this has not however been confirmed.

Voxel Dot Net CBMS Multiple Code Injection Vulnerabilities

Ulf Harnhammar <[email protected]> has provided the following link, which will mark all clients of the system as deleted:

dltclnt.php?choice=yes&idnum=clientid

Voxel Dot Net CBMS Multiple Code Injection Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Voxel Dot Net CBMS Multiple Code Injection Vulnerabilities

References:

• CBMS Homepage (Voxel Dot Net)