Trend Micro Control Manager 'id' Parameter SQL Injection Vulnerability

Bugtraq ID:	55706
Class:	Input Validation Error
CVE:	CVE-2012-2998
Remote:	Yes
Local:	No
Published:	Sep 27 2012 12:00AM
Updated:	Sep 27 2012 12:00AM
Credit:	Tom Gregory, Spentera
Vulnerable:	Trend Micro Control Manager 6.0 Trend Micro Control Manager 5.5
Not Vulnerable:

Trend Micro Control Manager 'id' Parameter SQL Injection Vulnerability

Trend Micro Control Manager is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Trend Micro Control Manager 'id' Parameter SQL Injection Vulnerability

An attacker can exploit this issue through a browser.

The following example code is available:

• /data/vulnerabilities/exploits/55706.py

Trend Micro Control Manager 'id' Parameter SQL Injection Vulnerability

Solution:
Updates are available. Please see the references for more information.

Trend Micro Control Manager 'id' Parameter SQL Injection Vulnerability

References:

• Trend Micro Control Manager Homepage (Trend Micro)
  
• Trend Micro Homepage (Trend Micro)