SQL Injection Vulnerability in bfExplorer 0.0.6

Risk: Medium
Local: No
Remote: Yes

CVSS Base Score: 7.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

Armorize Technologies Security Advisory Advisory No: Armorize-ADV-2006-0007 Status: Partial Date: 2006/10/31 Summary: Armorize-ADV-2006-0007 discloses SQL injection vulnerability that is found in bfExplorer (BytesFall Explorer, http://sourceforge.net/projects/bfexplorer), which is is a web-based file manager written in PHP and JavaScript and licensed under the GNU GPL. Affected Software: bfExplorer 0.0.6 Vulnerability Description: SQL Injection Analysis/Impact: Unexpected SQL statements may lead to the disclosure of sensitive information and security breach on the host server. Detection/Exploit(partial): bfExplorer-0.0.6/libs/sessions.lib.php Protection/Solution: 1. Escape every questionable query. 2. Utilize prepared statements to create secure database queries. Credit: Security Team at Armorize Technologies, Inc. (security (at) armorize (dot) com [email concealed]) Additional Information: Link to this Armorize advisory http://www.armorize.com/advisory.php?Keyword=Armorize-ADV-2006-0007 Links to all Armorize advisories http://www.armorize.com/advisory/ Links to Armorize vulnerability database http://www.armorize.com/resources/vulnerability.php Armorize Technologies is delivering the world's most advanced source code analysis solution for Web application security based on its award-winning and patent-pending verification technologies. Addressing security early in the software development life cycle (SDLC), Armorize CodeSecure proactively identifies and traces vulnerabilities in Web application source code, effectively hardening websites against today's ever growing security threats. CodeSecure's zero-false-positive accuracy, traceback support and Web 2.0-based interface make it the premium Web application security solution. For more information please visit: http://www.armorize.com.

Vote for this issue:


Thanks for you vote!


Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2021, cxsecurity.com


Back to Top