lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <CALH-=7weT_pS7EBZb8pAE-6QPVAf6FUZ-pSziDedRG2oybtACA@mail.gmail.com> Date: Tue, 3 Feb 2015 20:29:33 +0100 From: Steffen Rösemann <steffen.roesemann1986@...il.com> To: fulldisclosure@...lists.org Subject: [FD] SQL injection vulnerability in Pragyan CMS v.3.0 Advisory: SQL injection vulnerability in Pragyan CMS v.3.0 Advisory ID: SROEADV-2015-11 Author: Steffen Rösemann Affected Software: Pragyan CMS v.3 Vendor URL: https://github.com/delta/pragyan, http://delta.nitt.edu/ Vendor Status: vendor did not respond after initial communication CVE-ID: - ========================== Vulnerability Description: ========================== Pragyan CMS v. 3 suffers from a SQL injection vulnerability that can be abused even by unauthenticated attackers. ================== Technical Details: ================== The user-profile of registered users of Pragyan CMS v.3 is vulnerable to SQL injection attacks. A user-profile can be found in the following location of a common Pragyan CMS installation: http://{TARGET}/user:1 Exploit-Example: http:// {TARGET}/user:1%27+and+1=2+union+select+database%28%29,version%28%29,3+--+ ========= Solution: ========= Vendor notified, did not respond after initial communication. If you use Pragyan CMS v.3, please locate the file userprofile.lib.php and use my patch (see [5], usage at your own risk!). ==================== Disclosure Timeline: ==================== 18-Jan-2015 – found the vulnerability 19-Jan-2015 - informed the developers (see [3]) 19-Jan-2015 – release date of this security advisory [without technical details] 19-Jan-2015 - forked the project to keep it available/researchable in its current state for other researchers [4] 03-Feb-2015 - release date of this security advisory 03-Feb-2015 - provided a patch for vulnerability (see [5]) 03-Feb-2015 - send to FullDisclosure ======== Credits: ======== Vulnerability found and advisory written by Steffen Rösemann. =========== References: =========== [1] http://delta.nitt.edu/ / https://github.com/delta/pragyan [2] http://sroesemann.blogspot.de/2015/01/sroeadv-2015-11.html [3] https://github.com/delta/pragyan/issues/206 [4] https://github.com/sroesemann/pragyan [5] http://pastebin.com/ip2gGYuS _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Powered by blists - more mailing lists