CVE-2004-2668

Vulnerability

Interchange versions before 4.8.9 contain a SQL injection vulnerability. The exact vector is not fully detailed, but the official release notes for version 4.8.9 [1] state that a security hole with possible SQL injection was fixed. The vulnerability exists in unknown components of the application. Affected versions: all prior to 4.8.9.

Exploitation

An attacker can exploit this vulnerability remotely without authentication. The reference [1] does not provide specific steps, but given it is SQL injection, the attacker likely sends crafted input to vulnerable parameters. The attack vector is unknown but may involve HTTP requests to the Interchange CGI.

Impact

Successful exploitation allows remote attackers to execute arbitrary SQL commands against the underlying database. This could lead to unauthorized reading or manipulation of sensitive data, including SQL access credentials and other application data.

Mitigation

The vulnerability is fixed in Interchange version 4.8.9, released on 2004-03-29 [1]. Users should upgrade to this version or later. No workarounds are documented in the available reference.