Dynix WebPAC Input Validation Holes Let Remote Users Inject SQL Commands
|
|
SecurityTracker Alert ID: 1011073
|
|
SecurityTracker URL: http://securitytracker.com/id?1011073
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Aug 26 2004
|
Impact: Disclosure of user information, Execution of arbitrary code via network, Modification of user information, User access via network
|
Description: A vulnerability was reported in the Dynix (Epixtech) WebPAC software. A remote user can inject SQL commands.
Wil Allsopp reported that WebPAC does not properly validate user-supplied input. A remote user can submit a specially crafted request
to inject SQL commands to be executed by the underlying database.
A remote user can exploit this flaw to access the application
without authenticating or execute operating system commands using stored procedures.
Other Dynix products may also be affected.
The
vendor has reportedly been notified without response.
|
Impact: A remote user can inject SQL commands to execute arbitrary operating system commands on the target system.
|
Solution: No solution was available at the time of this entry.
|
Vendor URL: www.dynix.com/ (Links to External Site)
|
Cause: Input validation error
|
Reported By: Wil Allsopp <rogueclient@yahoo.co.uk>
|
Message History:
None.
|
Source Message Contents
|
Date: Tue, 24 Aug 2004 14:45:57 +0100 (BST)
From: =?iso-8859-1?q?Wil=20Allsopp?= <rogueclient@yahoo.co.uk>
Subject: Dynix Webpac Input Validation
|
Package: Epixtech / Dynix Webpac
Date: 23/08/2004
Problem Class: Input validation
Advisory: Wil Allsopp
Email: straylight@technophreaks.co.uk
Vendor status: Informed but unresponsive
Description
-----------
Webpac is a widely deployed library solutions system
(search google for webpac) that allows catalogue
services to be provided through a web interface.
The Epixtech / Dynix range of library solutions
software, most notably Webpac, contain numerous SQL
injection flaws.
Why is this a problem?
----------------------
Login bypass, command execution via stored procedures
and denial of service attacks against back end
databases. Both early and recent versions are
vulnerable.
___________________________________________________________ALL-NEW Yahoo! Messenger - all new feature
s - even more fun! http://uk.messenger.yahoo.com
|
|
