SpamTitan web GUI Multiple Input Validation Vulnerabilities
BID:63166
Info
SpamTitan web GUI Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 63166 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 16 2013 12:00AM |
| Updated: | Oct 16 2013 12:00AM |
| Credit: | V. Paulikas |
| Vulnerable: |
SpamTitan SpamTitan 5.08 |
| Not Vulnerable: | |
Discussion
SpamTitan web GUI Multiple Input Validation Vulnerabilities
SpamTitan is prone to the following input-validation vulnerabilities:
1. A cross-site scripting vulnerability
2. An SQL-injection vulnerability
3. A remote command-execution vulnerability
Exploiting these issues could allow an attacker to execute arbitrary commands in context of the application, steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Other attacks are also possible.
SpamTitan 5.13 and prior versions are vulnerable.
SpamTitan is prone to the following input-validation vulnerabilities:
1. A cross-site scripting vulnerability
2. An SQL-injection vulnerability
3. A remote command-execution vulnerability
Exploiting these issues could allow an attacker to execute arbitrary commands in context of the application, steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Other attacks are also possible.
SpamTitan 5.13 and prior versions are vulnerable.
Exploit / POC
SpamTitan web GUI Multiple Input Validation Vulnerabilities
An attacker can exploit some of these issues with a browser. To exploit a cross-site scripting vulnerability, an attacker must entice an unsuspecting user to follow a malicious URI.
An attacker can exploit some of these issues with a browser. To exploit a cross-site scripting vulnerability, an attacker must entice an unsuspecting user to follow a malicious URI.
Solution / Fix
SpamTitan web GUI Multiple Input Validation Vulnerabilities
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
SpamTitan web GUI Multiple Input Validation Vulnerabilities
References:
References:
- SpamTitan Homepage (SpamTitan)