bugtraq - DDIVRT-2009-25 IPsession SQL Injection Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <200905211514.n4LFEMwh009613@www5.securityfocus.com>
Date: Thu, 21 May 2009 09:14:22 -0600
From: ddvulnalert@...fronline.com
To: bugtraq@...urityfocus.com
Subject: DDIVRT-2009-25 IPsession SQL Injection Vulnerability

Title
-----
DDIVRT-2009-25 IPsession SQL Injection Vulnerability

Severity
--------
Medium

Date Discovered
---------------
March 31, 2009

Discovered By
-------------
Digital Defense, Inc. Vulnerability Research Team
Credit: David Marshall and r@...$

Vulnerability Description
-------------------------
IPsession runs a web interface on port 8090 that requires valid login credentials.  This interface uses user supplied input to form a database query and is vulnerable to SQL injection.  This may be used to bypass authentication.

Solution Description
--------------------
Limit access to the login page to internal networks and trusted users only.

Tested Systems / Software (with versions)
------------------------------------------
Unknown version on Windows 2003

Vendor Contact
--------------
Name: IPcelerate
Website: http://www.ipcelerate.com/ipsession.html