Информационная безопасность
[RU] switch to English


Дополнительная информация

  Ежедневная сводка ошибок в Web-приложениях (PHP, ASP, JSP, CGI, Perl)

  zenphoto Multiple Path Disclosure and Cross Site Scripting Vulnerabilities

  [email protected] <= 3.1.9e (naboard_pnr.
php) Remote File Include Vulnerability

  Exploits Minichat v6 Remote File Include

  SH-News (RFI)

From:tamriel_(at)_gmx.net <tamriel_(at)_gmx.net>
Date:12 октября 2006 г.
Subject:[Full-disclosure] XeoPort <= 0.81 SQL Injection Vulnerability

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

     Advisory: XeoPort <= 0.81 SQL Injection Vulnerability
 Release Date: 10/12/2006
Last Modified: 10/12/2006
       Author: Tamriel [tamriel at gmx dot net]
  Application: XeoPort <= 0.81
         Risk: Moderate
Vendor Status: not contacted
  Vendor Site: www.xeoman.com | www.xeoman.de


Overview:

  Quote from www.xeoman.de:

 "XeoPort imports emails from an IMAP or POP3 server into
  your MySQL database. The text part and/ or the entire message
  will be imported. An elegant way for Outlook Express users
  (like me) to extract messages from Microsofts proprietary
  binary format. I tried Access via Outlook but it turned out
  to be buggy all the way. The additional script show.php
  (folder goodie) uses Outlook Express to display the entire
  message if you want to get your hands on attached files. It
  can be used to dump the entire MySQL database back into Outlook
  Express messages providing kind of a backup."

     There are is a SQL injection vulnerability which can be
     exploited by malicious people to conduct SQL injection attacks.

     The vulnerability has been discovered in the latest version,
     0.81. Other versions may also be affected.


Details:

     SQL Injection in index.php

     The Input `$xp_body_text` parameter isn't properly sanitised
     before being used in a SQL query.
     
     An attacker must send an Email with 7bit encoding to perform
     this attack.
     
     Some other variables may also be affected.


Proof of Concept:

     Not needed


Solution/Fix:

     You must have register_globals enabled to run this script,
     disable it and edit the source code to ensure that input is
     properly sanitised and change all input variables.

     Use functions like PHP's htmlentities() and
     mysql_real_escape_string() functions.


Disclosure Timeline:

     10/12/2006 - Discovery of the vulnerabilities
     10/12/2006 - Public disclosure
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (MingW32)

iD8DBQFFLbRdqBhP+Twks7oRCgsRAKCGPWGfNMIiC2oU7rX4ti4gKWxqEgCglwZH
CmdsPUHCLdgYlBjmFzk2Sz4=
=1cU+
-----END PGP SIGNATURE-----


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

О сайте | Условия использования
© SecurityVulns, 3APA3A, Владимир Дубровин
Нижний Новгород