Sophos Cyberoam CVE-2014-5503 SQL Injection Vulnerability

Bugtraq ID:	70213
Class:	Input Validation Error
CVE:	CVE-2014-5503
Remote:	Yes
Local:	No
Published:	Sep 15 2014 12:00AM
Updated:	Sep 15 2014 12:00AM
Credit:	agix
Vulnerable:	Sophos CyberoamOS 10.6.1 RC-4 Sophos CyberoamOS 10.4 GA
Not Vulnerable:	Sophos CyberoamOS 10.6.1 GA

Sophos Cyberoam CVE-2014-5503 SQL Injection Vulnerability

Sophos Cyberoam is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

The following versions are vulnerable:

Sophos CyberoamOS 10.4 GA and prior
Sophos CyberoamOS 10.6.1 RC-4 and prior

Sophos Cyberoam CVE-2014-5503 SQL Injection Vulnerability

An attacker can exploit this issue using a web browser.

Sophos Cyberoam CVE-2014-5503 SQL Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Sophos Cyberoam CVE-2014-5503 SQL Injection Vulnerability

References:

• Sophos Homepage (Sophos)
  
• Cyberoam Security Bulletin Release September 2014 Cyberoam Security Notice (agix)
  
• Sophos Cyberoam add_guest_user Blind SQL Injection Remote Code Execution Vulnera (agix)