SPIP 1.9.2 Unspecified SQL Injection Vulnerability
BID:49780
Info
SPIP 1.9.2 Unspecified SQL Injection Vulnerability
| Bugtraq ID: | 49780 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 23 2011 12:00AM |
| Updated: | Sep 23 2011 12:00AM |
| Credit: | Gilles Vincent |
| Vulnerable: |
SPIP SPIP 1.9.2 |
| Not Vulnerable: |
SPIP SPIP 1.9.2 k |
Discussion
SPIP 1.9.2 Unspecified SQL Injection Vulnerability
SPIP is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
SPIP 1.9.2 is vulnerable; other versions may also be affected.
SPIP is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
SPIP 1.9.2 is vulnerable; other versions may also be affected.
Solution / Fix
SPIP 1.9.2 Unspecified SQL Injection Vulnerability
Solution:
Vendor fixes are available. Please see the references for more information.
Solution:
Vendor fixes are available. Please see the references for more information.
References
SPIP 1.9.2 Unspecified SQL Injection Vulnerability
References:
References:
- Security vulnerabilities found in SPIP version 1.9.2 (Steve Kinzler)
- SPIP Homepage (SPIP)