vendor:
OpenConf
by:
Egidio Romano aka EgiX
7,5
CVSS
HIGH
SQL Injection
89
CWE
Product Name: OpenConf
Affected Version From: 4.00
Affected Version To: 4.11
Patch Exists: YES
Related CWE: CVE-2012-1002
CPE: a:openconf:openconf
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: None
2012
OpenConf <= 4.11 (author/edit.php) Remote Blind SQL Injection Exploit
User input passed through $_POST['pid'] seems correctly sanitised by the safeSQLstr() function, but in the query at line 105, single quotes aren't used before concatenate the user input into the query string. This can be exploited to conduct a Blind SQL Injection attack. Successful exploitation of this vulnerability requires at least a record into the 'paper' table, and 'Edit Submission' to be enabled.
Mitigation:
Version 4.12 released to address this vulnerability.
