Glossaire Module for XOOPS '/modules/glossaire/glossaire-aff.php' SQL Injection Vulnerability

Bugtraq ID:	67460
Class:	Input Validation Error
CVE:	CVE-2014-3935
Remote:	Yes
Local:	No
Published:	May 19 2014 12:00AM
Updated:	Jun 09 2014 12:12AM
Credit:	AtT4CKxT3rR0r1ST
Vulnerable:
Not Vulnerable:

Glossaire Module for XOOPS '/modules/glossaire/glossaire-aff.php' SQL Injection Vulnerability

Glossaire module for XOOPS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

An attacker can leverage this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Glossaire 1.0 is vulnerable; other versions may also be affected.

Glossaire Module for XOOPS '/modules/glossaire/glossaire-aff.php' SQL Injection Vulnerability

Attackers can use a browser to exploit this issue.

The following example URI is available:

http://www.example.com/modules/glossaire/glossaire-aff.php?lettre=A[SQL INJECTION]

Glossaire Module for XOOPS '/modules/glossaire/glossaire-aff.php' SQL Injection Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Glossaire Module for XOOPS '/modules/glossaire/glossaire-aff.php' SQL Injection Vulnerability

References:

• XOOPS Homepage (XOOPS)