Infinity WEB Input Validation Error Lets Remote Users Inject SQL Commands
|
|
SecurityTracker Alert ID: 1010593
|
|
SecurityTracker URL: http://securitytracker.com/id?1010593
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Jun 28 2004
|
Impact: User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Advisory: Zone-H
|
Version(s): 1.0
|
Description: D'Amato Luigi from Zone-h Security Labs reported an input validation vulnerability in Infinity WEB. A remote user can bypass the authentication mechanism.
It is reported that the login page does not properly validate user-supplied input. A remote user can reportedly inject SQL commands
to bypass the authentication mechanism and gain access to the application.
The vendor was reportedly notified on June 1, 2004.
The
original advisory is available at:
http://www.zone-h.org/en/advisories/read/id=4892/
|
Impact: A remote user can inject SQL commands to gain access to the application.
|
Solution: The vendor has reportedly issued a patch.
|
Vendor URL: www.websoft.it/ (Links to External Site)
|
Cause: Input validation error
|
Reported By: D'Amato Luigi <admin@securitywireless.info>
|
Message History:
None.
|
Source Message Contents
|
Date: Sun, 27 Jun 2004 11:43:07 +0100
From: D'Amato Luigi <admin@securitywireless.info>
Subject: ZH2004-14SA (security advisory):Sql Injection in Infinity WEB
|
06/27/2004
Vendor contacted: June 1st 2004
Published: June 26th 2004
Title: Infinity WEB
Vulnerable versions :1.0 unpatched
Type: Sql Injection
Author: D'Amato Luigi from Zone-h Security Labs -
securitywireless@zone-h.it - admin@securitywireless.info
Vendor: http://www.websoft.it/
Description
**********
Zone-H Security Team has discovered a security flaw in Infinity WEB .
This vulnerability could allow malicious attackers to bypass the
authentication mechanish without having an account.
Details
********************************************
Due to an improper login validation in the login page it is possible to
bypass the authentication mechanism
Solution
**********
The vendor has been contacted and has released a patch
---
D'Amato Luigi from Zone-h Security Labs -
securitywireless@zone-h.it -
admin@securitywireless.info
Admin Security Wireless
http://www.securitywireless.info
http://www.zone-h.org/en/advisories/read/id=4892/
|
|
