Red Hat CloudForms Management Engine 'MiqPolicyController' Component SQL Injection Vulnerability

Bugtraq ID:	64524
Class:	Input Validation Error
CVE:	CVE-2013-2050
Remote:	Yes
Local:	No
Published:	Nov 13 2013 12:00AM
Updated:	Dec 31 2013 12:39AM
Credit:	Ramon de C Valle
Vulnerable:
Not Vulnerable:

Red Hat CloudForms Management Engine 'MiqPolicyController' Component SQL Injection Vulnerability

Red Hat CloudForms Management Engine is prone to SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

CloudForms Management Engine 2.0 is vulnerable; other versions may also be affected.

Red Hat CloudForms Management Engine 'MiqPolicyController' Component SQL Injection Vulnerability

An attacker can exploit this issue using a web browser.

The following exploit is available:

• /data/vulnerabilities/exploits/64524.rb

Red Hat CloudForms Management Engine 'MiqPolicyController' Component SQL Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information

Red Hat CloudForms Management Engine 'MiqPolicyController' Component SQL Injection Vulnerability

References: