JVN#31506102: Aipo vulnerable to SQL injection

Aipo from Aimluck, Inc. is groupware including functions such as scheduler and intra-office blogging. Aipo contains a SQL injection vulnerability.

Impact

Users who can login and do not have access privileges to information in Aipo may view or alter information.

The developer has confirmed that a third party without login credentials cannot view or alter information.

Solution

Update the Software
Update to the latest version according to the information provided by the developer.

This issue has been resolved in Aipo Version 5.1.1.

Products Affected

• Aipo versions prior to 5.1.1
• Aipo for ASP versions prior to 5.1.1