OneOrZero AIMS Security Bypass and SQL Injection Vulnerabilities

Bugtraq ID:	50107
Class:	Access Validation Error
CVE:	CVE-2011-4214 CVE-2011-4215
Remote:	Yes
Local:	No
Published:	Oct 13 2011 12:00AM
Updated:	Nov 03 2011 04:23PM
Credit:	Yuri Goltsev of Positive Technologies
Vulnerable:
Not Vulnerable:

OneOrZero AIMS Security Bypass and SQL Injection Vulnerabilities

OneOrZero AIMS is prone to a security-bypass vulnerability and an SQL-injection vulnerability.

An attacker can exploit these issues to bypass certain security restrictions, perform unauthorized actions, bypass filtering, and modify the logic of SQL queries.

OneOrZero AIMS 2.7.0 is affected; other versions may also be affected.

OneOrZero AIMS Security Bypass and SQL Injection Vulnerabilities

Attackers can use a browser to exploit this issue.

OneOrZero AIMS Security Bypass and SQL Injection Vulnerabilities

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

OneOrZero AIMS Security Bypass and SQL Injection Vulnerabilities

References:

• OneOrZero AIMS Homepage (OneOrZero)
  
• Security Lab PT-2011-20 (Security Lab)
  
• Security Lab PT-2011-21 (Security Lab)
  
• OneOrZero AIMS authentication bypass and SQLi vulnerabilities (US-CERT)