[SePro Advisory #1] SQL-Injection in PerlDesk

Dieses Thema im Forum "Sicherheit & Datenschutz" wurde erstellt von z4ratustra, 12. Februar 2006 .

Schlagworte:
  1. Diese Seite verwendet Cookies. Wenn du dich weiterhin auf dieser Seite aufhältst, akzeptierst du unseren Einsatz von Cookies. Weitere Informationen
  1. #1 12. Februar 2006
    [SePro Advisory #1] SQL-Injection in PerlDesk
    ===================================================

    Vendor: LogicNow
    Homepage: http://www.perldesk.com/
    Vulnerable versions: 1.x
    Login required: no
    Date: 06.02.05



    Credits:
    ================================
    Discovered by deluxe89 and Astovidatu
    [ http://www.security-project.org ]



    Description:
    ================================
    "PerlDesk is a feature packed web based help desk and email management application designed to streamline the operation
    of managing emails or support requests, with built in tracking and response logging. It is an ideal help desk solution
    for companies with one or more members of staff or for those who want to organise client support."
    (direct quote from Customer Service and Help Desk Software | LogicNow)



    Summary:
    ================================
    PerlDesk has got a SQL-Injection vulnerability, which allows potential users to read informations from the database.
    The "view"-parameter isn't filtered, so an attacker can manipulate the query.




    Proof of Concept:
    ================================
    Code:
    
    if ($ENV{'QUERY_STRING'} =~ /^view/) {
    $id = $q->param('view'); $statement = 'SELECT * FROM perlDesk_kb_entries WHERE id = ' . "$id";
    
    As one can see the "view"-parameter is stored in $id which is then passed to the SQL-Statement completely unfiltered.
    Using a malformed query string one can exploit this issue.

    For example "http://www.site.com/dir/kb.cgi?view=0 UNION SELECT 1,3,password,username,3,7 FROM users"

    If the user table is named "users", this query will read the username and password.



    Solution:
    ================================
    Upgrade to version 2.x.



    Exploit:
    ================================
    http://www.security-project.org/projects/board/attachment.php?attachmentid=42
     

  2. Anzeige

  3. Videos zum Thema
Die Seite wird geladen...
Similar Threads - SePro Advisory SQL
  1. Antworten:
    0
    Aufrufe:
    485
  2. Diagnoseprogramm

    ManiacKiller , 17. April 2011 , im Forum: Hardware & Peripherie
    Antworten:
    7
    Aufrufe:
    423
  3. Startup-Diagnoseprogramm

    Lock3 , 26. Oktober 2009 , im Forum: Anwendungssoftware
    Antworten:
    2
    Aufrufe:
    235
  4. Antworten:
    8
    Aufrufe:
    442
  5. Antworten:
    2
    Aufrufe:
    222