----------------------------------------------------------------------

Bist Du interessiert an einem neuen Job in IT-Sicherheit?


Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT-
Sicherheit:
http://secunia.com/secunia_vacancies/

----------------------------------------------------------------------

TITLE:
Ipswitch WhatsUp Professional "Login.asp" SQL Injection

SECUNIA ADVISORY ID:
SA15503

VERIFY ADVISORY:
http://secunia.com/advisories/15503/

CRITICAL:
Less critical

IMPACT:
Security Bypass, Manipulation of data

WHERE:
>From local network

SOFTWARE:
Ipswitch WhatsUp Professional 2005
http://secunia.com/product/5164/

DESCRIPTION:
Secunia Research has discovered a vulnerability in Ipswitch WhatsUp
Professional, which can be exploited by malicious people to conduct
SQL injection attacks.

Input passed in the "User Name" field in "NmConsole/Login.asp" is not
properly sanitised before being used in a SQL query. This can be
exploited to manipulate SQL queries by injecting arbitrary SQL code.

Successful exploitation e.g. allows changing the password of
arbitrary accounts, thereby making it possible to gain unauthorised
administrative access.

The vulnerability has been confirmed in version 2005 SP1. Other
versions may also be affected.

SOLUTION:
Apply Service Pack 1a.
http://www.ipswitch.com/Support/whatsup_professional/releases/wup2005sp1a.html

PROVIDED AND/OR DISCOVERED BY:
Independently discovered by:
* Carsten Eiram, Secunia Research.
* Anonymous person and reported via iDEFENSE.

ORIGINAL ADVISORY:
Secunia Research:
http://secunia.com/secunia_research/2005-13/

iDEFENSE:
http://www.idefense.com/application/poi/display?id=268&type=vulnerabilities

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------