Open Web Analytics 'owa_event' Parameter PHP Object Injection Vulnerability

Bugtraq ID:	66076
Class:	Input Validation Error
CVE:	CVE-2014-2294
Remote:	Yes
Local:	No
Published:	Mar 10 2014 12:00AM
Updated:	Mar 10 2014 12:00AM
Credit:	Egidio Romano
Vulnerable:
Not Vulnerable:

Open Web Analytics 'owa_event' Parameter PHP Object Injection Vulnerability

Open Web Analytics is prone to a remote PHP object-injection vulnerability because it fails to properly sanitize user-supplied input.

Attackers can exploit this issue to inject arbitrary object into the application. This may allow an attacker to create or overwrite files and conduct further attacks.

Open Web Analytics 1.5.6 is vulnerable; other versions may also be affected.

Open Web Analytics 'owa_event' Parameter PHP Object Injection Vulnerability

An attacker can exploit this issue using a web browser.

Open Web Analytics 'owa_event' Parameter PHP Object Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Open Web Analytics 'owa_event' Parameter PHP Object Injection Vulnerability

References:

• Open Web Analytics Homepage (Open Web Analytics )
  
• OWA 1.5.7 is now available (Open Web Analytics)
  
• OWA 1.5.7 Release Notes (Open Web Analytics)
  
• Secunia Research: Open Web Analytics PHP Object Injection Vulnerability (Secunia )