|
|
Info |
Last Modified |
| 10 months ago |
|
|
|
|
Description |
TWIG Webmail contains a flaw that will allow an attacker to inject arbitrary SQL code. The problem is that the id variable in the "personal.groups.inc.php3" module is not verified properly and will allow an attacker to inject or manipulate SQL queries.
|
|
Classification |
Location:
Remote/Network Access Required
Attack Type:
Information Disclosure,
Input Manipulation
Impact:
Loss of Confidentiality,
Loss of Integrity
Exploit:
Exploit Available
Disclosure:
OSVDB Verified
OSVDB:
Web Related
|
|
Solution |
Currently, there are no known upgrades or patches to correct this issue. It is possible to correct the flaw by implementing the following workaround(s): Simply add a proper quoted sign "'" to query string that using
int,mediumint, tinyint and so like field type as WHERE clause.
|
|
Products |
|
TWIG
 |
2.6.2 |
|
|
|
|
Credit |
Unknown or Incomplete
|
|
BlogsProvided by Technorati
|
None found at this time
|
|
|
