aMSN SQL Injection and Local File Include Vulnerabilities

Bugtraq ID:	62999
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 09 2013 12:00AM
Updated:	Oct 09 2013 12:00AM
Credit:	drone
Vulnerable:	aMSN aMSN 0.98.9
Not Vulnerable:

aMSN SQL Injection and Local File Include Vulnerabilities

aMSN is prone to an SQL-injection vulnerability and a local file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker can exploit these vulnerabilities to compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, use directory-traversal strings to execute local script code in the context of the application, or obtain sensitive information that may aid in further attacks.

aMSN 0.98.9 is vulnerable; other versions may also be affected.

aMSN SQL Injection and Local File Include Vulnerabilities

An attacker can exploit these issues using a web browser.

The following exploit is available:

• /data/vulnerabilities/exploits/62999.py

aMSN SQL Injection and Local File Include Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

aMSN SQL Injection and Local File Include Vulnerabilities

References:

• aMSN Homepage (aMSN)
  
• Commit [r12422] (aMSN)
  
• Commit [r12424] (aMSN)