Limny "escape()" SQL Injection Vulnerability

Secunia ID	SA50108
Release Date	01 Aug 2012
Criticality	Moderately Critical
Solution Status	Unpatched
Software	Limny 3.x
Where	From remote
Impact	Manipulation of data This includes vulnerabilities where a user or a remote attacker can manipulate local data on a system, but not necessarily be able to gain escalated privileges or system access. The most frequent type of vulnerabilities with this impact are SQL-injection vulnerabilities, where a malicious user or person can manipulate SQL queries.
Description	A vulnerability has been discovered in Limny, which can be exploited by malicious people to conduct SQL injection attacks. Input passed via e.g. the "q" parameter to index.php is not properly sanitised in the "escape()" function in incs/mysql.class.php before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. The vulnerability is confirmed in version 3.3.1. Other versions may also be affected.
Solution	No official solution is currently available.
Reported by	L0n3ly-H34rT
Original Advisory	http://packetstormsecurity.org/files/115148/Limny-3.3.1-Blind-SQL-Injection.html

© 1997-2013 Kaspersky Lab ZAO. All Rights Reserved.
Industry-leading Antivirus Software.
Registered trademarks and service marks are the property of their respective owners.
The authors' opinions do not necessarily reflect the official positions of Kaspersky Lab.