FreeBSD : OpenX -- SQL injection vulnerability (dee44ba9-08ab-11e2-a044-d0df9acfd7e5)
High Nessus Plugin ID 62422
SynopsisThe remote FreeBSD host is missing a security-related update.
DescriptionSecunia reports :
A vulnerability has been discovered in OpenX, which can be exploited by malicious people to conduct SQL injection attacks.
Input passed via the 'xajaxargs' parameter to www/admin/updates-history.php (when 'xajax' is set to 'expandOSURow') is not properly sanitised in e.g. the 'queryAuditBackupTablesByUpgradeId()' function (lib/OA/Upgrade/DB_UpgradeAuditor.php) before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
The vulnerability is confirmed in version 2.8.9. Prior versions may also be affected.
SolutionUpdate the affected package.