Multiple SQL injection and blind SQL Injection Vulnerabilities in Kiwi Syslog Web Access

Release date:
Updated on:

Affected Systems:
Kiwi Syslog Web Access 1.4.4
Description:
--------------------------------------------------------------------------------
Bugtraq id: 56996

Kiwi Syslog Web Access is a Web-based Access portal for Kiwi Syslog Server. It can filter and emphasize Kiwi Syslog Server system log events.

Kiwi Syslog Web Access 1.4.4 and other versions have remote SQL injection and blind SQL injection vulnerabilities, which allow attackers to corrupt applications and operate databases illegally.

<* Source: Mohd Izhar Ali

Link: http://packetstormsecurity.org/files/118945/kiwisyslog-sql.pdf
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Kiwi
----
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Http://www.kiwisyslog.com/