OcoMon is vulnerable to SQL injection
| ocomon-sql-injection (23085) |  Medium Risk |
Description:
OcoMon is vulnerable to SQL injection. A remote attacker could send a specially-crafted SQL statement to unknown parameters which would allow the attacker to add, modify or delete data in the back-end database.
Note: It is reported that the new version of OcoMon (1.21) is still vulnerable to SQL injection in the logon page if magic_quotes_gpc is disabled.
Platforms Affected:
- OcoMon, OcoMon prior to 1.21
Remedy:
Upgrade to the latest version of OcoMon (version 1.21 or later) available from the OcoMon Web site. See References.
Consequences:
Data Manipulation
References:
- OcoMon Web site, OcoMon Product Info at http://ocomonphp.sourceforge.net/index.php. (This site is in Portuguese.)
- BID-15386: OcoMon Multiple Unspecified SQL Injection Vulnerabilities
- CVE-2005-4662: Multiple SQL injection vulnerabilities in OcoMon 1.20, and possibly earlier versions, allow remote attackers to execute arbitrary SQL commands via unknown attack vectors in an unspecified input form, a different vulnerability than CVE-2005-4664.
- CVE-2005-4663: Cross-site scripting (XSS) vulnerability in OcoMon 1.20, and possibly earlier versions, allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors.
- CVE-2005-4664: SQL injection vulnerability in OcoMon 1.21, and possibly other versions, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the logon page, a different vulnerability than CVE-2005-4662.
- OSVDB ID: 20751: OcoMon Unspecified SQL Injection
- SA17470: OcoMon Unspecified SQL Injection Vulnerabilities
Reported:
Nov 11, 2005
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net