full-disclosure - IRM Security Advisory : RedDot CMS SQL injection vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <7B01ACCEDD4FFE48B12A55E2DB16A9304CA8E3@dccheltenham.local.irmplc.com>
Date: Mon, 21 Apr 2008 17:06:06 +0100
From: "Mark Crowther" <mark.crowther@...plc.com>
To: <full-disclosure@...ts.grok.org.uk>,
	<bugtraq@...urityfocus.com>
Subject: IRM Security Advisory : RedDot CMS SQL injection
	vulnerability

RedDot CMS SQL injection vulnerability (CVE Number: CVE-2008-1613)

http://www.irmplc.com/index.php/167-Advisory-026

Vulnerability Type/Importance: SQL injection/Critical

Problem Discovered:     12 February 2008

Vendor Contacted:       19 February 2008

Advisory Published:     21 April 2008

Abstract:

The RedDot CMS Product (http://www.reddot.com) is vulnerable to a
pre-authentication SQL injection vulnerability which, when exploited,
allows enumeration of all SQL database content.

Description:

The 'LngId' Parameter passed to IoRD.asp is responsible for assigning
the language context for the CMS application. The vulnerability exists
as a result of inadequate validation of user-supplied input within this
parameter.

Technical Details:

Normal input for the 'LngId' parameter contains a code such as ENG, DEU,
JP, denoting the language type. This parameter is not properly validated
and the injection of SQL statements within it allows attackers
unrestricted access to enumerate information from the database. For
example:

https://vulnerablehost.com:443/cms/ioRD.asp?Action=ShowMessage&LngId=ENG
.DGC0 FROM IO_DGC_ENG UNION SELECT min(name) FROM SYSOBJECTS where
xtype=char(85) and name> '' ORDER BY 1;-- &DisableAutoLogin=1

Proof of Concept:

A Proof of Concept (RDdbenum.py) has been developed to automate
enumeration of entire database content available from
http://www.irmplc.com/Tools/RDdbenum.py

Workaround / Solutions:

There are no known workarounds for this vulnerability

The Vendor has released a patch for this vulnerability, Release
7.5.1.86, available from normal Red Dot customer support contacts.

Tested / Affected Versions:

IRM confirmed the presence of this vulnerability in RedDot CMS version
7.5 Build 7.5.0.48, tested with Microsoft SQL Server 2005 database.

It is believed that this issue exists in RedDot CMS versions 6.5 and
7.0; however this has not been fully verified.

Credits:

Research and Advisory: Mark Crowther and Rodrigo Marcos

Disclaimer:

All information in this advisory is provided on an 'as is' basis in the
hope that it will be useful. Information Risk Management Plc is not
responsible for any risks or occurrences caused by the application of
this information.

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/