full-disclosure - 'PHP Grade Book' Unauthenticated SQL Database Export (CVE-2012-1670)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAKCW=4a6k51MDTjrmraUuofawqL2cxT6hOP3j8bn85H-n=o0_A@mail.gmail.com>
Date: Thu, 22 Mar 2012 10:10:15 -0400
From: Mark Stanislav <mark.stanislav@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: 'PHP Grade Book' Unauthenticated SQL Database
	Export (CVE-2012-1670)

'PHP Grade Book' Unauthenticated SQL Database Export (CVE-2012-1670)
Mark Stanislav - mark.stanislav@...il.com


I. DESCRIPTION
---------------------------------------
A vulnerability exists in admin/index.php that allows for an
unauthenticated user to export the entire application database by accessing
the 'Database Backup' method without restriction. Due to the way sessions
are handled, an attacker can then simply pass the username and
password-hash via cookies to assume the administrative role without ever
knowing the clear-text version of the password.


II. TESTED VERSION
---------------------------------------
1.9.4


III. PoC EXPLOIT
---------------------------------------
http://localhost/phpGradeBook/admin/index.php?action=SaveSQL


IV. SOLUTION
---------------------------------------
Upgrade to 1.9.5 or above.


V. REFERENCES
---------------------------------------
http://sourceforge.net/projects/php-gradebook/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1670


VI. TIMELINE
---------------------------------------
02/29/2012 - Initial vendor disclosure
02/29/2012 - Vendor response and commitment to fix
03/01/2012 - Vendor patched and released an updated version
03/22/2012 - Public disclosure

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/