bugtraq - LedgerSMB < 1.2.8, SQL-Ledger 2.x Multiple SQL Injection Issues

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <f5cca7ed0710090931h73cb50ft4f3212287561be98@mail.gmail.com>
Date: Tue, 9 Oct 2007 09:31:14 -0700
From: "Chris Travers" <chris.travers@...il.com>
To: bugtraq@...urityfocus.com
Subject: LedgerSMB < 1.2.8, SQL-Ledger 2.x Multiple SQL Injection Issues

Severity:  Critical
Effect:  Compromise of FInancial Data, deletion of audit trails,
alteration of system settings, disclosure of confidential information
possible in some setups.
Affected products:  LedgerSMB 1.0.0-1.2.7 , SQL-Ledger 2.x (all versions).

1:  SQL injection issue in invoice quantity field
2:  SQL injection issue in sort field.

Solution to issue on LedgerSMB:  Upgrade to 1.2.8.

Solution to issue on SQL-Ledger:  Unfortunately the maintainer of
SQL-Ledger has declined to fix any of the SQL injection issues we have
sent his way.  Even correcting these, there are many SQL injection
issues in that application.  Our official recommendation for
SQL-Ledger users is to restrict access to database relations to the
least privelege necessary.  While this does not entirely solve the
issues, it does limit the damage considerably.

Best Wishes,
Chris Travers