HTTP: SQL 'insert..values' Command Injection in URL

This signature detects attempts to perform an SQL injection attack against a web server. Some web applications may be vulnerable. A successful attack could result in a complete data compromise of the targeted website. However, it can be a false positive. To reduce false positives, it is strongly recommended that these signatures only be used to inspect traffic from the Internet to your organization's Web servers that use SQL backend databases to generate content and not to inspect traffic going from your organization to the Internet.

Extended Description

Multiple SQL injection vulnerabilities in Novell ZENworks Patch Management 6.x before 6.2.2.181 allow remote attackers to execute arbitrary SQL commands via the (1) Direction parameter to computers/default.asp, and the (2) SearchText, (3) StatusFilter, and (4) computerFilter parameters to reports/default.asp.

Affected Products

Novell zenworks_patch_management_server

References

BugTraq: 15220

CVE: CVE-2005-3315

URL: http://www.owasp.org/index.php/SQL_Injection

Short Name

HTTP:SQL:INJ:INSERT-VALUES

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: SQL 'insert..values' Command Injection in URL

Extended Description

Affected Products

References

Found a potential security threat?