oss-security - CVE-2014-9573: SQL Injection in manage_user

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Date: Sat, 17 Jan 2015 01:04:45 +0100
From: Damien Regad <dregad@...tisbt.org>
To: oss-security@...ts.openwall.com
Cc: advisory@...ridge.ch
Subject: CVE-2014-9573: SQL Injection in manage_user_page.php

Greetings,

Please update CVE-2014-9573 with the information below

Description:

The vulnerability can be used to manipulate existing SQL queries. An 
attacker can obtain potentially sensitive data and use it to elevate 
privileges within the application. It is also possible for certain 
configurations to upload a backdoor and gain complete access to the 
webserver or website.

The vulnerability exists due to insufficient filtration of the 
"MANTIS_MANAGE_USERS_COOKIE" HTTP COOKIE in "/manage_user_page.php" 
script. A remote user with administrative privileges can inject and 
execute arbitrary SQL code within the application’s database.

The exploit code below modifies the SQL query and injects malicious 
"INTO OUTFILE" statement. As a result,current MySQL user login will be 
written into the "/var/www/file.txt" file:

GET /manage_user_page.php?hideinactive=0 HTTP/1.1
Host: mantis
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: ru-RU,ru;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: 
MANTIS_MANAGE_USERS_COOKIE=0%3Ausername%20INTO%20OUTFILE%20%27/var/www/file.txt%27%20--%20%3A1%3A0
Connection: keep-alive

Successful exploitation requires that the MySQL account has FILE 
privileges within the database.

To exploit this vulnerability an attacker must create a specially 
crafted cookie for the application administrator. This can be achieved 
using XSS vulnerabilities

Affected versions:
- <= 1.2.19
- <= 1.3.0-beta.1

Fixed in versions:
- 1.2.19 (not yet released)
- 1.3.0-beta.2 (not yet released)

Patch:
See Github [1]

Credit:
This vulnerability was reported [2] by High-Tech Bridge Security 
Research Lab (https://www.htbridge.com/), via advisory ID HTB23243 [3].
The issue was fixed by Damien Regad (MantisBT Developer).

References:
Further details available in our issue tracker [4]

[1] http://github.com/mantisbt/mantisbt/commit/69c2d28d (1.2.x)
     http://github.com/mantisbt/mantisbt/commit/7cc4539f (1.3.x)
[2] https://www.mantisbt.org/bugs/view.php?id=17937
[3] https://www.htbridge.com/advisory/HTB23243
[4] https://www.mantisbt.org/bugs/view.php?id=17940

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.