Date: Sat, 17 Jan 2015 01:04:45 +0100 From: Damien Regad <dregad@...tisbt.org> To: oss-security@...ts.openwall.com Cc: advisory@...ridge.ch Subject: CVE-2014-9573: SQL Injection in manage_user_page.php Greetings, Please update CVE-2014-9573 with the information below Description: The vulnerability can be used to manipulate existing SQL queries. An attacker can obtain potentially sensitive data and use it to elevate privileges within the application. It is also possible for certain configurations to upload a backdoor and gain complete access to the webserver or website. The vulnerability exists due to insufficient filtration of the "MANTIS_MANAGE_USERS_COOKIE" HTTP COOKIE in "/manage_user_page.php" script. A remote user with administrative privileges can inject and execute arbitrary SQL code within the application’s database. The exploit code below modifies the SQL query and injects malicious "INTO OUTFILE" statement. As a result,current MySQL user login will be written into the "/var/www/file.txt" file: GET /manage_user_page.php?hideinactive=0 HTTP/1.1 Host: mantis Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: ru-RU,ru;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Cookie: MANTIS_MANAGE_USERS_COOKIE=0%3Ausername%20INTO%20OUTFILE%20%27/var/www/file.txt%27%20--%20%3A1%3A0 Connection: keep-alive Successful exploitation requires that the MySQL account has FILE privileges within the database. To exploit this vulnerability an attacker must create a specially crafted cookie for the application administrator. This can be achieved using XSS vulnerabilities Affected versions: - <= 1.2.19 - <= 1.3.0-beta.1 Fixed in versions: - 1.2.19 (not yet released) - 1.3.0-beta.2 (not yet released) Patch: See Github  Credit: This vulnerability was reported  by High-Tech Bridge Security Research Lab (https://www.htbridge.com/), via advisory ID HTB23243 . The issue was fixed by Damien Regad (MantisBT Developer). References: Further details available in our issue tracker   http://github.com/mantisbt/mantisbt/commit/69c2d28d (1.2.x) http://github.com/mantisbt/mantisbt/commit/7cc4539f (1.3.x)  https://www.mantisbt.org/bugs/view.php?id=17937  https://www.htbridge.com/advisory/HTB23243  https://www.mantisbt.org/bugs/view.php?id=17940
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ