Vulnerability: Blind SQL injection.

[nidhinca]

There is a critical vulnerability discovered on the Predictive Dialer Application by scanning Qualys.Express.

http://10.10.99.1/agc.new/astguiclient.php
http://10.10.99.1/

Issue: Blind SQL injection. This give access to the back end database of the application.

Installation details:

Centos 6.5 64Bit

Astguiclient:

Version: 2.10-401a

Build: 630508-2256


Kindly also avail us the root cause of this and fix this issues.

[mflorell]

That version is years old and we have patched many security holes since then. I would suggest upgrading to the latest svn/trunk version if you want a secure system.

[nidhinca]

Thanks for the reply. As we have done multiple customizations on the existing server, we will not be able to change the version.