Neoinvoice CVE-2012-4673 SQL-Injection Vulnerability

Bugtraq ID:	73854
Class:	Input Validation Error
CVE:	CVE-2012-4673
Remote:	Yes
Local:	No
Published:	Aug 25 2012 12:00AM
Updated:	Aug 25 2012 12:00AM
Credit:	Unknown
Vulnerable:	Thomas Hunter Neoinvoice -
Not Vulnerable:

Neoinvoice CVE-2012-4673 SQL-Injection Vulnerability

Neoinvoice is prone to a sql-injection vulnerability. SQL injection vulnerability in application/controllers/invoice.php in NeoInvoice might allow remote attackers to execute arbitrary SQL commands via vectors involving the sort_col variable in the list_items function, a different vulnerability than CVE-2012-3477.

Neoinvoice CVE-2012-4673 SQL-Injection Vulnerability

Attackers can use a browser to exploit this issue.

Neoinvoice CVE-2012-4673 SQL-Injection Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or you are aware of more recent information, please mail us at: [email protected]

Neoinvoice CVE-2012-4673 SQL-Injection Vulnerability

References:

• http://adamcaudill.com/2012/08/12/neoinvoice-blind-sql-injection-cve-2012-3477/ (MISC)
  
• https://github.com/mweimerskirch/neoinvoice/commit/501a9d5d261c718913cfc13d212b0 (CONFIRM)
  
• https://github.com/tlhunter/neoinvoice/issues/2 (MISC)