SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   Infinity WEB Vendors:   WebSoft
Infinity WEB Input Validation Error Lets Remote Users Inject SQL Commands
SecurityTracker Alert ID:  1010593
SecurityTracker URL:  http://securitytracker.com/id/1010593
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Jun 28 2004
Impact:   User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 1.0
Description:   D'Amato Luigi from Zone-h Security Labs reported an input validation vulnerability in Infinity WEB. A remote user can bypass the authentication mechanism.

It is reported that the login page does not properly validate user-supplied input. A remote user can reportedly inject SQL commands to bypass the authentication mechanism and gain access to the application.

The vendor was reportedly notified on June 1, 2004.

The original advisory is available at:

http://www.zone-h.org/en/advisories/read/id=4892/

Impact:   A remote user can inject SQL commands to gain access to the application.
Solution:   The vendor has reportedly issued a patch.
Vendor URL:  www.websoft.it/ (Links to External Site)
Cause:   Input validation error

Message History:   None.


 Source Message Contents

Subject:  ZH2004-14SA (security advisory):Sql Injection in Infinity WEB



06/27/2004

Vendor contacted: June 1st 2004
Published: June 26th 2004

Title: Infinity WEB
Vulnerable versions :1.0 unpatched

Type: Sql Injection

Author: D'Amato Luigi from Zone-h Security Labs -
securitywireless@zone-h.it - admin@securitywireless.info

Vendor: http://www.websoft.it/


Description

**********
Zone-H Security Team has discovered a security flaw in Infinity WEB .
This vulnerability could allow malicious attackers to bypass the
authentication mechanish without having an account.

Details

********************************************

Due to an improper login validation in the login page it is possible to
bypass the authentication mechanism

Solution

**********

The vendor has been contacted and has released a patch


---

D'Amato Luigi from Zone-h Security Labs -
securitywireless@zone-h.it -
admin@securitywireless.info
Admin Security Wireless
http://www.securitywireless.info




http://www.zone-h.org/en/advisories/read/id=4892/



 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC