[原文]SQL injection vulnerability in search.php in AtlantisFAQ Knowledge Base Software 2.03 and earlier allows remote attackers to execute arbitrary SQL commands via the searchStr parameter.
[CNNVD]Atlantis Knowledge Base Search.PHP SQL注入漏洞(CNNVD-200511-477)
AtlantisFAQ Knowledge Base是一款基于PHP的小型的知识库程序。
AtlantisFAQ Knowledge Base Software 2.03及更早版本的search.php存在SQL注入漏洞，可让远程攻击者通过searchStr参数执行任意SQL命令。
Atlantis Knowledge Base Software search.php searchStr Parameter SQL Injection
Remote / Network Access
Information Disclosure,
Input Manipulation
Loss of Confidentiality,
Loss of Integrity
Exploit Unknown
-
漏洞描述
Knowledge Base Software contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the search.php script not properly sanitizing user-supplied input to the searchStr variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.
-
时间线
2005-11-28
Unknow
Unknow
Unknow
-
解决方案
Currently, there are no known upgrades, patches, or workarounds available to correct this issue.
r0t is credited with the discovery of this vulnerability.
-
受影响的程序版本
Atlantis Knowledge Base 3.0
-
漏洞讨论
Atlantis Knowledge Base is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
Versions 3.0 and prior are reported to be vulnerable; other versions may also be affected.
-
漏洞利用
No exploit is required.
-
解决方案
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: vuldb@securityfocus.com <mailto:vuldb@securityfocus.com>.
生活只有在平淡无味的人看来才是空虚而平淡无味的。