oss-security - Re: CVE Request: Mambo CMS 4.6.x (4.6.5)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <410971781.2044468.1313174909659.JavaMail.root@zmail01.collab.prod.int.phx2.redhat.com>
Date: Fri, 12 Aug 2011 14:48:29 -0400 (EDT)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Cc: coley <coley@...re.org>
Subject: Re: CVE Request: Mambo CMS 4.6.x (4.6.5) | SQL
 Injection

Please use CVE-2011-2917

Thanks.

-- 
    JB


----- Original Message -----
> Mambo CMS 4.6.x (4.6.5) | SQL Injection
> 
> 
> 1. OVERVIEW
> 
> Mambo CMS 4.6.5 and lower versions are vulnerable to SQL Injection.
> 
> 
> 2. BACKGROUND
> 
> Mambo is a full-featured, award-winning content management system that
> can
> be used for everything from simple websites to complex corporate
> applications. It is used all over the world to power government
> portals,
> corporate intranets and extranets, ecommerce sites, nonprofit
> outreach,
> schools, church, and community sites. Mambo's "power in simplicity"
> also
> makes it the CMS of choice for many small businesses and personal
> sites.
> 
> 
> 3. VULNERABILITY DESCRIPTION
> 
> The "zorder" parameter was not properly sanitized upon submission to
> the
> administrator/index2.php url, which allows attacker to conduct SQL
> Injection attack. This could an attacker to inject or manipulate SQL
> queries
> in the back-end database, allowing for the manipulation or disclosure
> of
> arbitrary data.
> 
> 
> 4. VERSIONS AFFECTED
> 
> Tested on Mambo CMS 4.6.5
> 
> 
> 5. PROOF-OF-CONCEPT/EXPLOIT
> 
> http://localhost/mambo/administrator/index2.php?limit=10&order[]=11&boxchecked=0&toggle=on&search=sqli&task=&limitstart=0&cid[]=on&zorder=-1OR
> (SELECT 9999 FROM(SELECT
> COUNT(*),CONCAT(CHAR(58,98,112,101,58),(SELECT
> (CASE WHEN (9999=9999) THEN 1 ELSE 0
> END)),CHAR(58,110,100,107,58),FLOOR(RAND(0)*2))x FROM
> INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY
> x)a)&filter_authorid=62&hidemainmenu=0&option=com_typedcontent
> 
> 
> 6. SOLUTION
> 
> The vendor seems to discontinue the development. It is recommended to
> use
> another CMS in active development.
> 
> 
> 7. VENDOR
> 
> Mambo CMS Development Team
> http://mambo-developer.org
> 
> 
> 8. CREDIT
> 
> This vulnerability was discovered by Aung Khant, http://yehg.net, YGN
> Ethical Hacker Group, Myanmar.
> 
> 
> 9. DISCLOSURE TIME-LINE
> 
> 2010-11-31: notified vendor through bug tracker
> 2011-08-12: no patched version released up to date
> 2011-08-12: vulnerability disclosed
> 
> 
> 10. REFERENCES
> 
> Original Advisory URL:
> http://yehg.net/lab/pr0js/advisories/[mambo4.6_x]_sql_injection
> Mambo CMS:
> http://mambo-code.org/gf/download/frsrelease/388/791/MamboV4.6.5.zip
> 
> 
> #yehg [2011-08-12]

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.