Multiple input validation vulnerabilities in vtiger CRM allow attackers to exploit SQL injection, HTML injection, cross-site scripting, and local file include vulnerabilities. These vulnerabilities can lead to administrative access, stealing username and password pairs, stealing cookie-based authentication credentials, and retrieving arbitrary local files in the context of the Web server process. The vulnerabilities are related to the ones discussed in BID 11740 (SugarCRM Multiple Input Validation Vulnerabilities) discovered by James Bercegay and Damon Wood of the GulfTech Security Research Team, as vtiger is a fork of the SugarCRM project. An independent study by Daniel Fabian of SEC-CONSULT has confirmed the existence of several of these issues.
Softbiz Web Host Directory Script is prone to multiple SQL injection vulnerabilities. These issues occur because the application fails to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
Softbiz Web Host Directory Script is prone to multiple SQL injection vulnerabilities. These issues occur because the application fails to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
This module exploits a buffer overflow in ABBS Audio Media Player. The vulnerability occurs when adding an .lst, allowing arbitrary code execution with the privileges of the user running the application. This module has been tested successfully on ABBS Audio Media Player 3.1 over Windows XP SP3 and Windows 7 SP1.
freeForum is prone to multiple SQL injection vulnerabilities. These vulnerabilities could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks. Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
The vulnerability in MailEnable allows remote attackers to trigger a denial of service condition by issuing a malicious rename request following authentication.
The blogBuddies application is prone to multiple cross-site scripting vulnerabilities. These vulnerabilities are caused by a failure in the application to properly sanitize user-supplied input. An attacker can exploit these vulnerabilities to execute arbitrary script code in the browser of a victim user in the context of the affected site. This can lead to the theft of cookie-based authentication credentials and other attacks.
blogBuddies is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
Ezyhelpdesk is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
The CommodityRentals application is vulnerable to SQL injection. An attacker can exploit this vulnerability by injecting malicious SQL code into the 'user_id' parameter in the 'moviedetails.php' page. Successful exploitation could lead to compromise of the application, disclosure or modification of data, or exploitation of vulnerabilities in the underlying database implementation.
Services By CQR