Info

Disclosure

Dec 06, 2004

Discovery

Nov 12, 2004

Dates

Exploit

Dec 06, 2004

Solution

Unknown

Description

Ansel contains a flaw that will allow an attacker to inject arbitrary SQL code. The problem is that the image parameter is not verified properly before being submitted in a SQL query and will allow an attacker to inject or manipulate SQL queries.

Classification

Location: Remote/Network Access Required
Attack Type: Information Disclosure, Input Manipulation
Impact: Loss of Confidentiality, Loss of Integrity
Exploit: Exploit Available
Disclosure: OSVDB Verified
OSVDB: Web Related

Solution

Upgrade to version 2.2 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

Federico David Sacerdoti

Ansel

2.1

References

Security Tracker: 1012434
Bugtraq ID: 11824
Related OSVDB ID: 12237
Secunia Advisory ID: 12856
ISS X-Force ID: 18373
CVE ID: 2004-2266 (see also: NVD)
Vendor URL: http://freshmeat.net/projects/ansel/
Other Advisory URL: http://secunia.com/secunia_research/2004-17/advisory/

Credit

Secunia Security Advisories - sec-advsecunia.com - Secunia

Direct URL: http://osvdb.org/36218