Date: Wed, 23 Oct 2013 02:52:06 -0400 From: Adam Caudill <adam@...mcaudill.com> To: oss-security@...ts.openwall.com Subject: VICIDIAL 2.7 - SQL Injection, Command Injection Requestor: Adam Caudill, adam@...mcaudill.com Software: VICIDIAL (http://www.vicidial.org/vicidial.php) Vendor: The Vicidial Group (http://www.vicidial.com/) Vulnerability Type: Authenticated SQL Injection, Authenticated Command Injection Source Code: http://sourceforge.net/projects/astguiclient/files/astguiclient_2.7rc1.zip/download Flaws exist in /www/agc/manager_send.php SQL Injection: Line 285 Command Injection: Line 429 Affected Versions: 2.7RC1, 2.7, 2.8-403a (others likely) Current released version is vulnerable; vendor confirmed issue on 6/3, set timeline for mid-July release, has delayed continually. Vendor has deployed fixes to users of their hosted service, still no updates or advisory for OSS users. Affected lines of code: manager_send.php:285 $stmt="SELECT count(*) from web_client_sessions where session_name='$session_name' and server_ip='$server_ip';"; manager_send.php:429 passthru("/usr/local/bin/sipsak -M -O desktop -B \"$SIPSAK_prefix$campaign\" -r 5060 -s sip:$extension@...one_ip > /dev/null"); In both of these cases, parameters are passed through without validation or escaping. During setup, two accounts with hard-coded passwords are created (VDAD, VDCL), these can be used to bypass the authentication check, allowing access to where the SQL Injection vulnerability is, which can be used to bypass an additional check, thus giving access to the Command Injection vulnerability. The output from shell commands are returned in the server response. There are MANY other issues of various types in this software, but I am not documenting them. -- Adam Caudill adam@...mcaudill.com http://adamcaudill.com/ Content of type "text/html" skipped Download attachment "signature.asc" of type "application/pgp-signature" (802 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.