OSVDB ID: 20751 Title: OcoMon Unspecified SQL Injection |
Info |
|
|
Dates |
||||
|
|
Description |
OcoMon contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the unspecified scripts not properly sanitizing user-supplied input. This may allow an attacker to inject or manipulate SQL queries in the backend database. No further details have been provided. |
Classification |
Location:
Remote/Network Access Required
Attack Type: Information Disclosure, Input Manipulation Impact: Loss of Confidentiality, Loss of Integrity Exploit: Exploit Unknown Disclosure: OSVDB Verified OSVDB: Web Related |
Solution |
Upgrade to version 1.21 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds. However, even with the upgrade to 1.21, Secunia Research has found that SQL injection still exists in the logon page when "magic_quotes_gpc" is disabled. |
Products |
|
References |
|
Credit |
|