OSVDB ID: 37009 Title: Plesk auth.php3 PLESKSESSID Cookie SQL Injection |
Info |
|
|
Dates |
||||
|
|
Description |
Plesk contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the program not properly sanitizing the PLESKSESSID cookie before being used in SQL statements. This may allow an attacker to inject or manipulate SQL queries in the back-end database. |
Classification |
Location:
Remote / Network Access
Attack Type: Information Disclosure, Input Manipulation Impact: Loss of Confidentiality, Loss of Integrity Exploit: Exploit Unknown Disclosure: OSVDB Verified OSVDB: Web Related |
Solution |
Currently, there are no known workarounds or upgrades to correct this issue. However, SWSoft has released a patch to address this vulnerability. |
Products |
|
References |
|
Credit |
|