full-disclosure - web-erp 0.1.4 database access vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <002501c2dfa0$b87a9d40$2000a8c0@amerisuk.com>
From: rfox at amerisuk.com (Ryan Fox)
Subject: web-erp 0.1.4 database access vulnerability

==================================
Security REPORT web-erp 0.1.4 and earlier
==================================
Product: web-erp 0.1.4 and earlier
Vulnerabilities: full database access
Vendor: Phil Daintree (http://web-erp.sourceforge.net/)
Vendor-Status: E-Mail to "p.daintree@...a.co.nz" date: 27.02.2003
Vendor-Patch: Vendor reports problem fixed in new version 0.1.5 (27.02.2003)

Local: YES
Remote: YES

============
Introduction
============
>From web site:
"WEB-ERP aims to provide a company with all the tools it needs to manage
multi-currency debtors, multi-location stocks, multi-currency creditors as
well as it's general accounting needs."

=====================
Vulnerability Details
=====================
1) FULL DATABASE ACCESS

http-requests to:

---*---
http://server/logicworks.ini
---*---

display the contents of this configuration file, unless the web server is
specifically configured to handle .ini files differently.  The contents
include the MySQL username and password used by the application.  With this
username/password, a malicious person could connect to MySQL direct and add,
modify, and delete data.

severity: HIGH

=======
Remarks
=======
The author was very responsive and released a new, corrected version the
same day.

This vulnerability report was made using a recent post by Martin Eiszner as
a template.  Any similarity is no coincidence.

====================
Recommended Hotfixes
====================
Upgrade to 0.1.5, which the author reports fixes this problem.

=======
Contact
=======

Ryan Fox
rfox@...risuk.com