TestLink SQL Injection Vulnerability Fixed by 1.9.15


Description   (#A SQL injection vulnerability has been identified in TestLink.#A remote attacker could exploit it by sending crafted URLs that include SQL statements in order to modify or delete entries in some database tables.##This vulnerability is due to a lack of user input check.#Updated, 17/02/2016:#A proof of concept is available.)
     
Vulnerable Products   Vulnerable Software:
TestLink (TestLink) - 1.9, 1.9.01, 1.9.02, 1.9.03, 1.9.04, ..., 1.9.10, 1.9.11, 1.9.12, 1.9.13, 1.9.14
     
Solution   Version 1.9.15 of TestLink fixes this vulnerability.
     
CVE  
     
References   - TestLink Bug Tracker : 0007402 TestLink Security - SQL Injection
http://mantis.testlink.org/view.php?id=7402
     
Vulnerability Manager Detection   No
     
IPS Protection  
ASQ Engine alarm Available Since
SQL injection Prevention - GET : suspicious OR statement in URL
3.2.0
SQL injection Prevention - GET : suspicious combination of 'OR' or 'AND' statements in URL
3.2.0
SQL injection Prevention - GET : suspicious CREATE statement in URL
3.2.0
SQL injection Prevention - GET : suspicious CAST statement in URL
3.2.0
SQL injection Prevention - GET : suspicious OPENROWSET statement in URL
3.2.0
SQL injection Prevention - GET : suspicious DECLARE statement in URL
3.2.0
SQL injection Prevention - GET : suspicious OPENQUERY statement in URL
3.2.0
SQL injection Prevention - GET : suspicious shutdown statement in URL
3.2.0
SQL injection Prevention - GET : suspicious UNION SELECT statement in URL
3.2.0
SQL injection Prevention - GET : possible database version probing
3.2.0
SQL injection Prevention - GET : suspicious UPDATE SET statement in URL
3.2.0
SQL injection Prevention - GET : suspicious SELECT statement in URL
3.2.0
SQL injection Prevention - GET : suspicious INSERT statement in URL
3.2.0
SQL injection Prevention - GET : suspicious DROP statement in URL
3.2.0
SQL injection Prevention - GET : suspicious EXEC statement in URL
3.2.0
SQL injection Prevention - GET : block comment delimiters in URL
3.2.0
SQL injection Prevention - GET : suspicious combination of 'select' and 'sleep' statements in URL
5.0.0
SQL injection Prevention - GET : Evasion attempt with CAST and EXEC statements
5.0.0
SQL injection Prevention - GET : Authentication bypass attempt with OR statement
5.0.0
     


 
 
 
 
 Risk level 
Moderate 

 Vulnerability First Public Report Date 
2016-01-07 

 Target Type 
Server 

 Possible exploit 
Remote