Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 27 Aug 2014 23:14:31 +0100
From: "Benjamin Harris" <bch@...h.ai>
To: fulldisclosure@...lists.org, oss-security@...ts.openwall.com
Subject: XRMS SQLi to RCE 0day

Hi

OSS-Security: Can I request a CVE for this please?

XRMS Description:
----------------------

The most advanced open source customer relationship management 
(CRM), Sales Force Automation (SFA) suite: also features business 
intelligence (BI) tools, Computer Telephony Integration (CTI), and 
advanced plugin architecture. PHP/ADOdb/LAMP

Brief:
-------------------------------

I tried to report this to the developers/get it fixed a month ago, 
although I've had no response from the developers. This should work 
against latest, was found a long time ago, and I recently found it 
while brushing off some hard drives.

Details:
------------------------

We get SQL injection via $_SESSION poisoning which we use to 
retrieve admin credentials. We then authenticate with these 
credentials and exploit a trivial command injection. Attached is a 
working POC.

Many thanks,
Ben
View attachment "release.py" of type "text/x-python" (8063 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.