Secunia

r0t has discovered two vulnerabilities in ActiveCampaign KnowledgeBuilder, which can be exploited by malicious people to cause a DoS (Denial of Service) and conduct SQL injection attacks.

1) Input passed to the "article" parameter in "index.php" isn't properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Successful exploitation requires that "magic_quotes_gpc" is disabled.

2) Input passed to the "category" parameter in "index.php" isn't properly verified, before it is used when sending requests to the database. This can be exploited to cause a large amount of SQL queries to be sent to the database via an invalid "category" parameter.

Successful exploitation causes a vulnerable system to consume a large amount of CPU resources.

The vulnerabilities have been confirmed in the latest available version. Other versions may also be affected.

Solution
Update to version 2.50.

Provided and/or discovered by
r0t

Changelog
Further details available in Customer Area

Original Advisory
http://pridels.blogspot.com/2005/11/activecampaign-knowledgebuilder-vuln.html

Deep Links
Links available in Customer Area