Language Selection

English French German Italian Portuguese Spanish

Flaws Found in MySQL Tracking System

Filed under
Security

Flaws have been found in MySQL Eventum 1.5.5 and prior that allow malicious users to conduct cross-site scripting and SQL injection attacks.

Eventum is an issue-tracking system that can be used by support departments to track incoming technical support requests or by a software development team to organize tasks and bugs. According to MySQL AB's site, Eventum is used by the MySQL AB Technical Support team "to dramatically improve" its response times.

One of the flaws, reported on Monday by security alerts aggregator Secunia Inc., has to do with the way input is passed to the "id" parameter in "view.php," the "release" parameter in "list.php" and the "F" parameter in "get_jsrs_data.php."

According to Secunia's report, input is not properly sanitized before being returned to users. This can be used to execute arbitrary HTML and script code in a user's browser session in the context of an affected site.

Secunia's report goes on to say that certain input passed to the release, report and authentication classes is also not being properly sanitized before being used in a SQL query. This can be used to manipulate the queries by injecting arbitrary SQL code.

Secunia rates the bugs as moderately critical, but the researcher who originally found them-James Bercegay of GulfTech Security Research Team-reported that they're highly exploitable and that they should be patched immediately.

The flaws can be found in versions 1.5.5 and prior. Eventum users should update to Version 1.6.0, which was released on Saturday. Click here for the new version's release notes.

By Lisa Vaas
eWeek

More in Tux Machines

Canonical Publishes Impressive Roadmap for All of Their Ubuntu Products

Canonical is working on multiple projects at the same time, and it's often difficult to understand their plans, but Director of Product Strategy Engineering Olli Ries has shed some light on how their inner workings are structured and how things are evolving, from the inside out. Read more

Making the Case for Koha: Why Libraries Should Consider an Open Source ILS

When Engard educates people on what open source is, what it means to use open source software, what types of software are available, which companies use it, and who trusts it, they see that their fears are unfounded, she says. To back up her discussions with facts, she maintains bibliographies on open source and open source security. She also has a set of bookmarks on Delicious, and she wrote a book, Practical Open Source Software for Libraries. “[W]hen people come to me and say open source is too risky … I have facts and figures, just what librarians want, to say no, all software has potential risk associated with it. You have to evaluate software side by side, and look at it, and really take the time to compare it. … I know you’re going to pick the open source solution over the proprietary because it is so quickly developed, so quickly fixed, so ahead of the curve as far as technology is concerned.” Read more

Review of Ubuntu Phone – A Work Still Under Progress

However, what one must remember is that the Ubuntu Phone is still a work in progress. The company is issuing updates every month and is relying on its current user base regarding the feedback and ideas. Right now, only three Ubuntu phones are present in the market ranging from $186 to $328 roughly. Ubuntu has been in hibernation mode for the development of this OS for a long time and it looked like they might be consumer ready now, however, after seeing the Ubuntu Phone it looks like they might be far from that scenario right now. Read more

Android M news: Release date delayed, to come out in September or October?

Google reveals that the newest Android operating system initially codenamed as "Android M" will be delaying the release of Android M Developer Preview 3 for selected Nexus devices. The information was shared by the company's employee and moderator Wojtek Kaliciński on the Developer community page in Google+. Read more