Enspire eClient Unspecified SQL Injection Vulnerability

Bugtraq ID:	50398
Class:	Input Validation Error
CVE:	CVE-2011-1915
Remote:	Yes
Local:	No
Published:	Oct 27 2011 12:00AM
Updated:	Oct 27 2011 12:00AM
Credit:	Alastair Gray of Graycon Group
Vulnerable:	Dismasys, Inc. Enspire 7.3.2.7 Dismasys, Inc. eClient 7.3.2.3
Not Vulnerable:

Enspire eClient Unspecified SQL Injection Vulnerability

Enspire eClient is prone to an unspecified SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. This issue could trigger an authentication-bypass vulnerability.

Enspire 7.3.2.7 and eClient 7.3.2.3 are vulnerable; other versions may also be affected.

Enspire eClient Unspecified SQL Injection Vulnerability

Attacker can exploit this issue with a browser.

Enspire eClient Unspecified SQL Injection Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of any more recent information, please mail us at: [email protected].

Enspire eClient Unspecified SQL Injection Vulnerability

References:

• Enspire Homepage (Dimasys)
  
• Enspire eClient SQL injection allows authentication bypass (Alastair Gray)