XOOPS WebChat Module Input Validation Flaw Lets Remote Users Inject and Execute SQL Commands on the Underlying Database Server
Categorie: Vulnerability Posted: 2002-11-18 by ReCall Views: 388 Source: Click here
Current Rating: Not rated
Details
Description: An input validation vulnerability was reported in the XOOPS WebChat Module. A remote user can execute SQL commands on the database server.
It is reported that the software processes user-supplied input for the '$roomid' variable without properly filtering the input. A remote user can create a specially crafted value for that variable to execute SQL commands on the underlying SQL server.
Impact: A remote user can execute arbitrary SQL commands on the underlying SQL database server.
Solution: No solution was available at the time of this entry.
The author of the report has provided an unofficial patch, available in the Source Message and at:
