full-disclosure - hornbill supportworks SQL injection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <040001ce40d1$a6c872a0$f45957e0$@reactionis.co.uk>
Date: Wed, 24 Apr 2013 10:54:00 +0100
From: "research" <research@...ctionis.co.uk>
To: "'full-disclosure'" <full-disclosure@...ts.grok.org.uk>,
 "'bugtraq'" <bugtraq@...urityfocus.com>, <secalert@...urityreason.com>,
 <bugs@...uritytracker.com>, <vuln@...urity.nnov.ru>, <news@...uriteam.com>,
 <moderators@...db.org>, <submissions@...ketstormsecurity.org>,
 <submit@...ecurity.com>, <first-bulletins@...ts.first.org>,
 <vulnwatch@...nwatch.org>
Subject: hornbill supportworks SQL injection

Summary

SQL Injection Vulnerability in ITSM component of Hornbill Supportworks
Application

    CVE number: CVE-2013-2594

    Impact: High

    Vendor homepage: http://www.hornbill.com

    Vendor notified: 19/11/2012

    Vendor response: This issue has reportedly been fixed but the vendor
refused to give version details.

    Credit: Joseph Sheridan of ReactionIS

Affected Products

Supportworks ITSM versions 1.0.0 and possibly other versions

Details

There is a SQL injection vulnerability in the ITSM component of the
Supportworks Application. The vulnerable file is calldiary.php found in the
/reports folder of the webroot. The following URL demonstrates the issue:

http://vulnhost.com/reports/calldiary.php?callref=VULN 

This attack can be used to take full control of the host by writing a php
webshell document (using mysql 'into outfile') to the webroot.

Impact

An attacker may be able to take full control of the Supportworks server and
execute arbitrary operating-system commands.

Solution

Upgrade to the latest available ITSM version - contact Vendor for more
details.

http://www.reactionpenetrationtesting.co.uk 

http://www.reactionpenetrationtesting.co.uk/research.html 

http://www.reactionpenetrationtesting.co.uk/security-testing-services.html 

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/