Sharetronix 'invite_users[]' Parameter SQL Injection Vulnerability
BID:67680
Info
Sharetronix 'invite_users[]' Parameter SQL Injection Vulnerability
| Bugtraq ID: | 67680 |
| Class: | Input Validation Error |
| CVE: |
CVE-2014-3415 |
| Remote: | Yes |
| Local: | No |
| Published: | May 28 2014 12:00AM |
| Updated: | May 28 2014 12:00AM |
| Credit: | High-Tech Bridge Security |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
Sharetronix 'invite_users[]' Parameter SQL Injection Vulnerability
Sharetronix is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
An attacker can leverage this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Sharetronix 3.3 and prior are vulnerable.
Sharetronix is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
An attacker can leverage this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Sharetronix 3.3 and prior are vulnerable.
Exploit / POC
Sharetronix 'invite_users[]' Parameter SQL Injection Vulnerability
Attackers can use a browser to exploit this issue.
Attackers can use a browser to exploit this issue.
Solution / Fix
Sharetronix 'invite_users[]' Parameter SQL Injection Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Sharetronix 'invite_users[]' Parameter SQL Injection Vulnerability
References:
References:
- ShareTronix Homepage (ShareTronix)