CGI Generic SQL Injection (2nd pass)

high Nessus Plugin ID 42479

Synopsis

A web application is potentially vulnerable to SQL injection.

Description

By providing specially crafted parameters to CGIs, Nessus was able to get an error from the underlying database. This error suggests that the CGI is affected by a SQL injection vulnerability.

An attacker may exploit this flaw to bypass authentication, read confidential data, modify the remote database, or even take control of the remote operating system.

Solution

Modify the relevant CGIs so that they properly escape arguments.

See Also

https://en.wikipedia.org/wiki/SQL_injection

http://www.securiteam.com/securityreviews/5DP0N1P76E.html

http://www.nessus.org/u?e5c79f44

http://www.nessus.org/u?11ab1866

Plugin Details

Severity: High

ID: 42479

File Name: torture_cgi_sql_injection2.nasl

Version: 1.24

Type: remote

Family: CGI abuses

Published: 11/12/2009

Updated: 1/19/2021

Supported Sensors: Nessus

Risk Information

CVSS v2

Risk Factor: High

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

Required KB Items: Settings/enable_web_app_tests

Reference Information

CWE: 20, 713, 722, 727, 751, 77, 801, 810, 89, 928, 929