cygnux.org sysPass up to 1.0.9 ajax/ajax_search.php search sql injection : 8/19/2015 10:58:20 AM

Communicate with co-workers in real time. Used by Netflix, Dropbox & Salesforce. $0/unlimited users. Get started >>
From our sponsors
 

 

Vulnerability Advisories
Vulnerabilities of scip VulDB

cygnux.org sysPass up to 1.0.9 ajax/ajax_search.php search sql injection
8/17/2015 7:00:00 PM

General

scipID: 77319
Affected: cygnux.org sysPass up to 1.0.9
Published: 08/18/2015
Risk: critical

Created: 08/19/2015
Entry: 65.3% complete

Summary

A vulnerability classified as critical has been found in cygnux.org sysPass up to 1.0.9. This affects an unknown function of the file ajax/ajax_search.php. The manipulation of the argument search with an unknown input leads to a sql injection vulnerability. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

SQL injection vulnerability in cygnux.org sysPass 1.0.9 and earlier allows remote authenticated users to execute arbitrary SQL commands via the search parameter to ajax/ajax_search.php.

The weakness was shared 08/18/2015. This vulnerability is uniquely identified as CVE-2015-6516. It is possible to initiate the attack remotely. Technical details of the vulnerability are known, but there is no available exploit.

By approaching the search of inurl:ajax/ajax_search.php it is possible to find vulnerable targets with Google Hacking.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

CVSS

Base Score: 6.0 (CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:P) [?]
Temp Score: 6.0 (CVSS2#E:ND/RL:ND/RC:ND) [?]

CPE

Exploiting

Class: Sql injection
Local: No
Remote: Yes

Availability: No
Google Hack: inurl:ajax/ajax_search.php

Countermeasures

Recommended: no mitigation known
0-Day Time: 0 days since found

Timeline

08/18/2015 | Advisory disclosed
08/19/2015 | VulDB entry created
08/19/2015 | VulDB entry updated

Sources

CVE: CVE-2015-6516 (mitre.org) (nvd.nist.org) (cvedetails.com)

 

You are receiving this email because you subscribed to this feed at feedmyinbox.com

If you no longer wish to receive these emails, you can unsubscribe from this feed, or manage all your subscriptions

Diberdayakan oleh Blogger.