lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-Id: <201404192217.s3JMHQ67020398@sf01web1.securityfocus.com>
Date: Sat, 19 Apr 2014 22:17:26 GMT
From: craig.arendt@...atumsecurity.com
To: bugtraq@...urityfocus.com
Subject: Blind SQL Injection Vulnerability in KnowledgeTree <= 3.7.0.2

Product description:
============
KnowledgeTree is document management system that makes it easy to secure, share, track and manage the documents and records.
============

KnowledgeTree Blind SQL Injection (CVE-2014-2737)
============

The application is vulnerable to blind SQL injection which is exploitable through /webservice/clienttools/services/mdownload.php. This issue is exploitable without authentication.

Details:
----------------------
The vulnerable code is in the get_active_session function in the KTAPI_UserSession class. In this location the query isn't parameterized when looking up the active session. In the getFileName function an unvalidated 'u' parameter is passed.

Exploitable from:
/webservice/clienttools/services/mdownload.php

POC is withheld.
The CVE project assigned CVE-2014-2737 to this issue.

Vendor Response:
1. The open source project was shut down, and the vendor doesn’t have a place to post a patch. The vendor does have a patch available that works for the open source project if you ask them. 
2. Upgrade to the KnowledgeTree on premise product which is patched against this issue.

Timeline:
============
February 25, 2014, Vulnerability identified
February 25, 2014, Product vendor notification
March 14, 2014, Vendor confirmed the issue
March 26, 2014, Vendor fix reviewed
March 28, 2014, Vendor fix confirmed
March 28, 2014, Vendor has a patch available for the open source product
April 20, 2014, Disclosure

Research:
============
Craig Arendt, Stratum Security
http://www.stratumsecurity.com

Disclaimer: 
The information provided in this advisory is provided as is without warranty of any kind.

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ