Editor Login | Register
Ekle

> World > Security
E-RESERV ID_loc SQL Injection - Security - World -
CWRedLight
(Date : 24.04.2008 18:55:10)


E-RESERV ID_loc SQL Injection
Secunia Advisory: SA29914  
Release Date: 2008-04-24

Critical:
Moderately critical
Impact: Manipulation of data
Where: From remote
Solution Status: Unpatched

Software:E-RESERV 2.x

Description:
JIKI Team has reported a vulnerability in E-RESERV, which can be exploited by malicious people to conduct SQL injection attacks.

Input passed to the "ID_loc" parameter in index.php is not properly sanitised before being used in an SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

The vulnerability is reported in version 2.1. Other versions may also be affected.

Solution:
Edit the source code to ensure that input is properly sanitised.

Provided and/or discovered by:
JIKI Team

Original Advisory:
http://milw0rm.com/exploits/5487










Derecelendir
Kaynak http://secunia.com/advisories/29914/
İçerik İhbarı
Bağlantılar: bilgininefendisi.net

Open Source Document Project AUP&TOS