ID de Prueba:	1.3.6.1.4.1.25623.1.0.902010
Categoría:	Web application abuses
Título:	SQL-Ledger Multiple Vulnerabilities
Resumen:	SQL-Ledger is prone to multiple vulnerabilities.
Descripción:	Summary: SQL-Ledger is prone to multiple vulnerabilities. Vulnerability Insight: - The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the request. This can be exploited to perform actions with the privileges of a target user, who is tricked into visiting a malicious website. - Input passed via customer names, vendor names, the DCN description field in 'Accounts Receivables', and the description field in 'Accounts Payable', is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which is executed in a user's browser session in context of an affected site when the malicious data is viewed. - Input passed via the 'id' parameter when searching for vendors is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. - Input passed via the 'countrycode' field in 'Preferences' is not properly sanitised before used to include files. This can be exploited to include arbitrary '.pl' files from the local system via directory traversal attacks. Vulnerability Impact: Successful exploitation will allow attacker to conduct cross-site request forgery attacks and by malicious users to conduct script insertion and SQL injection attacks, or bypass certain security restrictions. Affected Software/OS: SQL-Ledger version 2.8.24 and prior. Solution: Upgrade to SQL-Ledger version 2.8.30 or later. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2009-3580 Bugtraq: 20091221 SQL-Ledger â?? several vulnerabilities (Google Search) http://www.securityfocus.com/archive/1/508559/100/0/threaded http://secunia.com/advisories/37877 XForce ISS Database: sqlledger-am-csrf(54964) https://exchange.xforce.ibmcloud.com/vulnerabilities/54964 Common Vulnerability Exposure (CVE) ID: CVE-2009-3581 BugTraq ID: 37431 http://www.securityfocus.com/bid/37431 XForce ISS Database: sqlledger-accounts-xss(54965) https://exchange.xforce.ibmcloud.com/vulnerabilities/54965 Common Vulnerability Exposure (CVE) ID: CVE-2009-3582 XForce ISS Database: sqlledger-id-sql-injection(54966) https://exchange.xforce.ibmcloud.com/vulnerabilities/54966 Common Vulnerability Exposure (CVE) ID: CVE-2009-3583 XForce ISS Database: sqlledger-countrycode-file-include(54967) https://exchange.xforce.ibmcloud.com/vulnerabilities/54967 Common Vulnerability Exposure (CVE) ID: CVE-2009-3584 XForce ISS Database: sqlledger-cookie-weak-security(54968) https://exchange.xforce.ibmcloud.com/vulnerabilities/54968 Common Vulnerability Exposure (CVE) ID: CVE-2009-4402
Copyright	Copyright (C) 2009 Greenbone AG

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.