Samsara CVE-2010-4942 SQL-Injection Vulnerability

Bugtraq ID:	73618
Class:	Input Validation Error
CVE:	CVE-2010-4942
Remote:	Yes
Local:	No
Published:	Oct 09 2011 12:00AM
Updated:	Oct 09 2011 12:00AM
Credit:	Unknown
Vulnerable:	E-Xoopport Samsara 3.1 E-Xoopport Samsara 3.0 RC1 E-Xoopport Samsara 3.0 Beta E-Xoopport Samsara 3.0
Not Vulnerable:

Samsara CVE-2010-4942 SQL-Injection Vulnerability

Samsara is prone to a sql-injection vulnerability. SQL injection vulnerability in location.php in the eCal module in E-Xoopport Samsara 3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the lid parameter.

Samsara CVE-2010-4942 SQL-Injection Vulnerability

Attackers can use a browser to exploit this issue.

Samsara CVE-2010-4942 SQL-Injection Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or you are aware of more recent information, please mail us at: [email protected]

Samsara CVE-2010-4942 SQL-Injection Vulnerability

References:

• E-Xoopport - Samsara <= 3.1 (eCal module) Remote Blind SQL Injection - CXSecurit (SREASON)
  
• E-Xoopport - Samsara <= 3.1 - (eCal module) Blind SQL Injection Exploit (EXPLOIT-DB)
  
• http://packetstormsecurity.org/1009-exploits/exoopportecal-sql.txt (MISC)
  
• IBM X-Force Exchange Beta (XF)