FreeBSD : OpenX -- SQL injection vulnerability (dee44ba9-08ab-11e2-a044-d0df9acfd7e5)

high Nessus Plugin ID 62422

Language:

Synopsis

The remote FreeBSD host is missing a security-related update.

Description

Secunia reports :

A vulnerability has been discovered in OpenX, which can be exploited by malicious people to conduct SQL injection attacks.

Input passed via the 'xajaxargs' parameter to www/admin/updates-history.php (when 'xajax' is set to 'expandOSURow') is not properly sanitised in e.g. the 'queryAuditBackupTablesByUpgradeId()' function (lib/OA/Upgrade/DB_UpgradeAuditor.php) before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

The vulnerability is confirmed in version 2.8.9. Prior versions may also be affected.

Solution

Update the affected package.

Plugin Details

Severity: High

ID: 62422

File Name: freebsd_pkg_dee44ba908ab11e2a044d0df9acfd7e5.nasl

Version: 1.5

Type: local

Family: FreeBSD Local Security Checks

Published: 10/4/2012

Updated: 1/6/2021

Supported Sensors: Nessus

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:openx, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Patch Publication Date: 9/27/2012

Vulnerability Publication Date: 9/14/2012

Reference Information

Secunia: 50598

Detections

Analytics