Detections
Analytics

eclime login.php SQL Injection

high Nessus Plugin ID 45065

Language:

Synopsis

A web application on the remote host has a SQL injection vulnerability.

Description

The version of eclime running on the remote web server has a SQL injection vulnerability. The application fails to properly sanitize input passed to the 'email_address' and 'password' parameters of 'login.php'.

Regardless of PHP's 'magic_quotes_gpc' setting, a remote attacker can exploit this by making a specially crafted POST request, which would result in the execution of arbitrary SQL queries.

Solution

Upgrade to eclime 1.1.1b or later.

See Also

http://www.nessus.org/u?b4b900ca

Plugin Details

Severity: High

ID: 45065

File Name: eclime_login_sqli.nasl

Version: 1.9

Type: remote

Family: CGI abuses

Published: 3/16/2010

Updated: 6/1/2022

Configuration: Enable thorough checks (optional)

Supported Sensors: Nessus

Vulnerability Information

Required KB Items: www/eclime

Excluded KB Items: Settings/disable_cgi_scanning

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2/6/2010

Vulnerability Publication Date: 2/6/2010

Reference Information

BID: 38625

Secunia: 38307