A vulnerability and a security issue have been reported in Webmatic, which can be exploited by malicious users to bypass certain security restrictions or by malicious people to conduct SQL injection attacks.

1) Input passed to unspecified parameters is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

The vulnerability is reported in versions prior to 2.6.2.

2) The administration interface does not correctly restrict generic administrators from performing certain actions. This can e.g. by exploited to perform a database backup.

The security issue is reported in versions prior to 2.7.

Solution
Update to version 2.7.

Provided and/or discovered by
Reported by the vendor.

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://www.valarsoft.com/index.php?page=home&notizie=&notID=144#npos144
http://www.valarsoft.com/index.php?page=home&notizie=&notID=145#npos145

Deep Links
Links available to Secunia VIM customers