Hitachi Business Logic - Container input form SQL injection
| hitachi-businesslogic-input-sql-injection (23877) |  Medium Risk |
Description:
Hitachi Business Logic - Container (BLC) is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL commands to an input form which could allow the attacker to add, modify or delete data in the back-end database.
Consequences:
Data Manipulation
Remedy:
Upgrade to the appropriate fixed software version for your system, as listed in Hitachi Support Software Vulnerability Information HS05-025. See References.
References:
- HITACHI Inspire the Next: Computer & Network Systems Site.
- Hitachi Support Software Vulnerability Information HS05-025: Multiple Vulnerabilities of Hitachi Business Logic - Container.
- BID-16067: Hitachi Business Logic Multiple Input Validation Vulnerabilities
- BID-16602: Hitachi Business Logic Multiple Input Validation Vulnerabilities
- CVE-2005-4578: Multiple SQL injection vulnerabilities in Hitachi Business Logic - Container (BLC) P-2443-9114 01-00 through 02-06 on Windows, and P-1M43-9111 01-01 through 02-00 on AIX, allow remote attackers to execute arbitrary SQL commands via unknown attack vectors in an unspecified input form.
- CVE-2006-0772: SQL injection vulnerability in Hitachi Business Logic - Container 02-03 through 03-00-/B on Windows, and 03-00 through 03-00-/B on Linux, allows remote attackers to execute arbitrary SQL commands via unspecified vectors in the extended receiving box function.
- OSVDB ID: 22063: Hitachi Business Logic Container (BLC) Unspecified Input Form SQL Injection
- OSVDB ID: 23099: Hitachi Business Logic Container (BLC) Unspecified SQL Injection
- SA18213: Hitachi Business Logic Multiple Vulnerabilities
- SA18817: Hitachi Business Logic Cross-Site Scripting and SQL Injection
- SECTRACK ID: 1015420: Hitachi Business Logic - Container Input Validation Holes Permit SQL Injection, Cross-Site Scripting, and HTTP Response Splitting Attacks
- VUPEN/ADV-2006-0532: Hitachi Business Logic SQL Injection and Cross Site Scripting Vulnerabilities
Platforms Affected:
- Hitachi Business Logic - Container
Reported:
Dec 27, 2005
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net