Vulnerable Systems:
* Web Application and Database Firewall versions prior to March 9, 2010
* SecureSphere versions 5.0 through 7.0.
Protection provided by the Imperva device against attacks such as SQL injection and Cross-Site Scripting is negated, allowing unfiltered requests through to protected applications.
An attacker can use this flaw to bypass firewall protections. Anyone with the ability to interact with protected web applications and databases can exploit this vulnerability. Only minimal skill is required and the bypass can be incorporated into existing exploitation frameworks and security testing tools. Exploitation of this issue does not permanently affect the device; each evasion request must contain the bypass payload.
