CVE-2011-0549 – Symantec Web Gateway forget.php SQL Injection Vulnerability

https://notcve.org/view.php?id=CVE-2011-0549

SQL injection vulnerability in forget.php in the management GUI in Symantec Web Gateway 4.5.x allows remote attackers to execute arbitrary SQL commands via the username parameter. Vulnerabilidad de inyección SQL en forget.php en la administración de Symantec Web Gateway v4.5.x, permite a atacantes remotos ejecutar comandos SQL de su elección a través del parámetro username. This vulnerability allows remote attackers to inject arbitrary SQL on vulnerable installations of the Symantec Web Gateway appliance. Authentication is not required to exploit this vulnerability. The specific flaw exists within the username parameter of POST requests to the forget.php script. The parameter is not sanitized and a remote attacker can abuse this to inject arbitrary SQL into the underlying database. • http://secunia.com/advisories/45146 http://securitytracker.com/id?1025753 http://www.securityfocus.com/bid/48318 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2011&suid=20110707_00 http://www.zerodayinitiative.com/advisories/ZDI-11-233 https://exchange.xforce.ibmcloud.com/vulnerabilities/68428 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •