ExoPHPDesk.faq.php.Remote.SQL.Injection

Release Date Mar 01, 2007
Severity medium
Impact The execution of arbitrary SQL commands on the system.
Description It indicates a possible exploit of a SQL injection vulnerability in ExoPHPDesk. This flaw is due to an input validation error in the "kb_view_in()" [class/kb.php] function (called via "faq.php") that does not validate the "id" parameter before it is used in SQL statements, which could be exploited by malicious users to conduct SQL injection attacks.
Affected Products EXO PHPDesk version 1.2.1 and prior.
Recommended Actions Currently we are not aware of any vendor-supplied patches for this issue.
Coverage IPS VCM
Common Vulnerabilities and Exposures (CVE) CVE-2007-0676
Reference/s http://www.frsirt.com/english/advisories/2007/0452 (FrSIRT) http://www.securityfocus.com/bid/22338 (BugTraq)

Fortinet