DDIVRT-2009-26 LogRover SQL Injection Authentication Bypass

Title

DDIVRT-2009-26 LogRover SQL Injection Authentication Bypass

Severity

Medium

Date Discovered

May 12, 2009

Discovered By

Digital Defense, Inc. Vulnerability Research Team
Credit: Geoff Humes and r@b13$

Vulnerability Description

The login screen of the LogRover web interface is vulnerable to a SQL Injection which can allow remote attackers to
login to the system via an authentication bypass.

Solution Description

Limit access to the login page to internal networks and trusted users only.

Tested Systems / Software (with versions)

LogRover version 2.3 for Windows XP

Vendor Contact

Name: LogRover
Website: http://www.logrover.com/