SQL Buddy 'page' Parameter Directory Traversal Vulnerability
BID:74589
Info
SQL Buddy 'page' Parameter Directory Traversal Vulnerability
| Bugtraq ID: | 74589 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 11 2015 12:00AM |
| Updated: | May 11 2015 12:00AM |
| Credit: | John Page |
| Vulnerable: |
SQL Buddy SQL Buddy 1.3.3 |
| Not Vulnerable: | |
Discussion
SQL Buddy 'page' Parameter Directory Traversal Vulnerability
SQL Buddy is prone to a directory-traversal vulnerability.
Remote attackers can use specially crafted requests with directory-traversal sequences ('../') to overwrite arbitrary files in the context of the application. This may aid in further attacks.
SQL Buddy is prone to a directory-traversal vulnerability.
Remote attackers can use specially crafted requests with directory-traversal sequences ('../') to overwrite arbitrary files in the context of the application. This may aid in further attacks.
Exploit / POC
SQL Buddy 'page' Parameter Directory Traversal Vulnerability
An attacker can exploit this issue using standard commands and readily available tools.
An attacker can exploit this issue using standard commands and readily available tools.
Solution / Fix
SQL Buddy 'page' Parameter Directory Traversal Vulnerability
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
SQL Buddy 'page' Parameter Directory Traversal Vulnerability
References:
References:
- SQL Buddy Homepage (SQL Buddy)
- Sqlbuddy Path Traversal Vulnerability (Seclists.org)