Ushahidi Multiple Security Vulnerabilities

Bugtraq ID:	54744
Class:	Unknown
CVE:	CVE-2012-3468 CVE-2012-3469 CVE-2012-3470 CVE-2012-3471 CVE-2012-3472 CVE-2012-3473 CVE-2012-3474 CVE-2012-3475 CVE-2012-3476
Remote:	Yes
Local:	No
Published:	Jul 31 2012 12:00AM
Updated:	Aug 09 2012 11:02PM
Credit:	1) Timothy D. Morgan, Kees Cook, and postmodern 2) Kees Cook and Dennison Williams 3) Reported by internal dev team 4) Wil Clouser 5) Amy K. Farrell
Vulnerable:
Not Vulnerable:

Ushahidi Multiple Security Vulnerabilities

Ushahidi is prone to multiple security vulnerabilities, including:

1. Multiple SQL-injection vulnerabilities
2. Multiple security-bypass vulnerabilities
3. An information-disclosure vulnerability
4. A session-hijacking vulnerability
5. Multiple HTML-injection vulnerabilities

Successfully exploiting these issues allows remote attackers to compromise the software, retrieve information, modify data, bypass intended security protections, disclose sensitive information, gain unauthorized access, and execute HTML and script code in the context of the affected site to steal cookie-based authentication credentials; other attacks are also possible.

Ushahidi versions prior to 2.5 are vulnerable.

Ushahidi Multiple Security Vulnerabilities

Currently, we are not aware of any exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Ushahidi Multiple Security Vulnerabilities

Solution:
Updates are available. Please see the references for more information.

Ushahidi Multiple Security Vulnerabilities

References:

• Ushahidi Homepage (Ushahidi )