lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <4C743F5C.2000006@ngenuity-is.com>
Date: Tue, 24 Aug 2010 14:53:32 -0700
From: Adam Baldwin <adam_baldwin@...nuity-is.com>
To: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: Nagios XI users.php SQL Injection

 Nagios XI users.php SQL Injection

Advisory Information
Advisory ID: NGENUITY-2010-008
Date published: 8/24/2010

Vulnerability Information
Class: SQL Injection (SQLi)

Software Description
Nagios XI is the commercial / enterprise version of the open source
Nagios project.

Vulnerability Description
Nagios XI prior to version 2009R1.3 is vulnerable to SQL Injection. It
is possible for specially designed queries to extract data via the
database error messages. Authentication and access to users.php is
required. It is possible to also use this SQL injection has a remote XSS
vector as the error message is not properly sanitized.


Technical Description
The records variable on the users.php command is not properly sanitized
and allows for injection of SQL commands. Stacked queries are also
allowed into the postgres database.

http://example.com/nagiosxi/admin/users.php?records=int8((select >
password from xi_users where username= >
CHR(110)||CHR(97)||CHR(103)||CHR(105)||CHR(111)||CHR(115)||CHR(97)||CHR(100)||CHR(109)||CHR(105)||CHR(110)))&sortby=username&sortorder=asc&search=&page=1

The password hash of the nagiosadmin user would be displayed in the
error message as a result of this query.


Credits
This vulnerability was discovered by Adam Baldwin

Original Advisory:
http://ngenuity-is.com/advisories/2010/aug/24/nagios-xi-usersphp-sql-injection/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ