CVE-2011-3688

Multiple SQL injection vulnerabilities in Sonexis ConferenceManager 9.3.14.0 allow remote attackers to execute arbitrary SQL commands via (1) the g parameter to Conference/Audio/AudioResourceContainer.asp or (2) the txtConferenceID parameter to Login/HostLogin.asp.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://securityreason.com/securityalert/8401
http://www.solutionary.com/index/SERT/Vuln-Disclosures/Sonexis-SQL-Injection.html	Exploit

Configurations

Configuration 1 (hide)

cpe:2.3:a:sonexis:conferencemanager:9.3.14.0:*:*:*:*:*:*:*

History

No history.

Information

Published : 2011-09-27 19:55

Updated : 2024-02-28 11:41

NVD link : CVE-2011-3688

Mitre link : CVE-2011-3688

CVE.ORG link : CVE-2011-3688

JSON object : View

Products Affected

sonexis

conferencemanager

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2011-3688", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2011-09-27T19:55:03.390", "references": [{"url": "http://securityreason.com/securityalert/8401", "source": "cve@mitre.org"}, {"url": "http://www.solutionary.com/index/SERT/Vuln-Disclosures/Sonexis-SQL-Injection.html", "tags": ["Exploit"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "Multiple SQL injection vulnerabilities in Sonexis ConferenceManager 9.3.14.0 allow remote attackers to execute arbitrary SQL commands via (1) the g parameter to Conference/Audio/AudioResourceContainer.asp or (2) the txtConferenceID parameter to Login/HostLogin.asp."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de inyecci\u00f3n SQL en Sonexis ConferenceManager v9.3.14.0 permiten a atacantes remotos ejecutar comandos SQL a trav\u00e9s de (1) el par\u00e1metro g de Conference/Audio/AudioResourceContainer.asp o (2) el par\u00e1metro txtConferenceID en Login/HostLogin.asp."}], "lastModified": "2012-02-14T04:09:01.353", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sonexis:conferencemanager:9.3.14.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5A66B800-AD5A-46C6-8D58-BDDBD97A28F0"}], "operator": "OR"}]}], "vendorComments": [{"comment": "Version 9.3 Patch 12 and 10.0.40 Patch 2 were available to customers in early October 2011. V9.2.11 is no longer supported and customers with support are able to upgrade to our latest release which includes the fixes. All customers were notified of the vulnerabilities and the fixes in early October 2011.", "lastModified": "2012-08-17T00:00:00", "organization": "Sonexis"}], "sourceIdentifier": "cve@mitre.org"}