Ecava IntegraXor CVE-2017-6050 SQL Injection Vulnerability

Bugtraq ID:	99164
Class:	Input Validation Error
CVE:	CVE-2017-6050
Remote:	Yes
Local:	No
Published:	Jun 20 2017 12:00AM
Updated:	Jun 20 2017 12:00AM
Credit:	Brian Martin of Tenable Security
Vulnerable:	Ecava IntegraXor 4.1.4410 Ecava IntegraXor 4.1.4393 Ecava IntegraXor 5.2.722.2 Ecava IntegraXor 5.2.1231.0 Ecava IntegraXor 5.0.413.0 Ecava IntegraXor 5.0 Ecava IntegraXor 4.1.4450 Ecava IntegraXor 4.1.4390 Ecava IntegraXor 4.1.4380 Ecava IntegraXor 4.1.4369 Ecava IntegraXor 4.1.4360 Ecava IntegraXor 4.1.4340 Ecava IntegraXor 4.00 Ecava IntegraXor 3.72 Ecava IntegraXor 3.71.4200 Ecava IntegraXor 3.71 Ecava IntegraXor 3.60.4061 Ecava IntegraXor 3.60.4050 Ecava IntegraXor 3.60.4032 Ecava IntegraXor 3.60 Ecava IntegraXor 3.6.4000.5 Ecava IntegraXor 3.6.4000.0 Ecava IntegraXor 3.5.4000.5 Ecava IntegraXor 3.5.3900.5 Ecava IntegraXor 3.5.3900.10 Ecava IntegraXor 3.5
Not Vulnerable:	Ecava IntegraXor 6.0.522.1

Ecava IntegraXor CVE-2017-6050 SQL Injection Vulnerability

Ecava IntegraXor is prone to an SQL-injection vulnerability because it fails to properly sanitize user-supplied input before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

IntegraXor versions 5.2.1231.0 and prior are vulnerable.

Ecava IntegraXor CVE-2017-6050 SQL Injection Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Ecava IntegraXor CVE-2017-6050 SQL Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Ecava IntegraXor CVE-2017-6050 SQL Injection Vulnerability

References:

• Advisory (ICSA-17-171-01) (cert.us)
  
• Vendor Homepage (integraxor)