VICIDIAL 'manager_send.php' CVE-2013-4467 SQL Injection Vulnerability

Bugtraq ID:	63340
Class:	Input Validation Error
CVE:	CVE-2013-4467
Remote:	Yes
Local:	No
Published:	Oct 23 2013 12:00AM
Updated:	Nov 11 2013 12:23AM
Credit:	Adam Caudill
Vulnerable:
Not Vulnerable:

VICIDIAL 'manager_send.php' CVE-2013-4467 SQL Injection Vulnerability

VICIDIAL is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input.

A successful exploit will allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Note: This issue was previously covered in BID 63288 (VICIDIAL Multiple SQL Injection and Command Injection Vulnerabilities), but has been moved to its own record for better documentation.

VICIDIAL 2.7RC1, 2.7 and 2.8-403a are vulnerable; other versions may also be affected.

VICIDIAL 'manager_send.php' CVE-2013-4467 SQL Injection Vulnerability

An attacker can exploit this issue using a web browser. The following metasploit exploit code is available:

• /data/vulnerabilities/exploits/63340.rb

VICIDIAL 'manager_send.php' CVE-2013-4467 SQL Injection Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

VICIDIAL 'manager_send.php' CVE-2013-4467 SQL Injection Vulnerability

References:

• VICIDIAL Call Center Suite Homepage (Vicidial Group)