full-disclosure - DDIVRT-2009-27 F2L-3000 files2links SQL Injection Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Mon, 25 Jan 2010 12:58:09 -0600
From: "ddivulnalert@...frontline.com" <ddivulnalert@...frontline.com>
To: full-disclosure@...ts.grok.org.uk
Subject: DDIVRT-2009-27 F2L-3000 files2links SQL Injection
	Vulnerability

Title
-----
DDIVRT-2009-27 F2L-3000 files2links SQL Injection Vulnerability

Severity
--------
Medium

Date Discovered
---------------
November 19, 2009

Discovered By
-------------
Digital Defense, Inc. Vulnerability Research Team
Credit: Rob Kraus, Chris Graham and r@...$

Vulnerability Description
-------------------------
The login page of the F2L-3000 version 4.0.0 is vulnerable to SQL
Injection. Exploitation of the vulnerability may allow attackers to
bypass authentication and access sensitive information stored on the
device.

Solution Description
--------------------
A patch is not available at this time. Possible workarounds include
disabling the vulnerable service, or limiting access to a set of trusted
IP addresses.

Tested Systems / Software 
-------------------------
F2L-3000 version 4.0.0 is the only platform that has been manually
tested. Earlier versions and other, similar models may also be
vulnerable as the platform is sold in various configurations.

Vendor Contact
--------------
Vendor Website: http://www.files2links.com/



_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/