Centre Online School Software Multiple Vulnerabilities
BID:10650
Info
Centre Online School Software Multiple Vulnerabilities
| Bugtraq ID: | 10650 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 03 2004 12:00AM |
| Updated: | Jul 03 2004 12:00AM |
| Credit: | "Manip" <[email protected]> reported these vulnerabilities. |
| Vulnerable: |
The Miller Group Centre 1.0 1 The Miller Group Centre 1.0 The Miller Group Centre 0.92 |
| Not Vulnerable: | |
Discussion
Centre Online School Software Multiple Vulnerabilities
It is reported that Centre is vulnerable to multiple vulnerabilities.
The first vulnerability lies in the ability to create new accounts without being loggin in and authorized to do so. It is reported that other similar authorization problems exist in the software as well.
A second vulnerability is reported to allow an attacker to execute arbitrary PHP scripts in the context of the web application server. These scripts would have to exist on the local filesystem of the server.
Multiple undisclosed SQL injection vulnerabilities are reported as well.
These issues are all reported in version 1.0 of Centre.
Update: Please see the message reference from Adrew Schmadeke <[email protected]>. This BID may be retired, or significantly modified.
It is reported that Centre is vulnerable to multiple vulnerabilities.
The first vulnerability lies in the ability to create new accounts without being loggin in and authorized to do so. It is reported that other similar authorization problems exist in the software as well.
A second vulnerability is reported to allow an attacker to execute arbitrary PHP scripts in the context of the web application server. These scripts would have to exist on the local filesystem of the server.
Multiple undisclosed SQL injection vulnerabilities are reported as well.
These issues are all reported in version 1.0 of Centre.
Update: Please see the message reference from Adrew Schmadeke <[email protected]>. This BID may be retired, or significantly modified.
Exploit / POC
Centre Online School Software Multiple Vulnerabilities
No exploit is required.
No exploit is required.
Solution / Fix
Centre Online School Software Multiple Vulnerabilities
Solution:
The vendor has released version 1.01 of the software. This upgrade version reportedly does not properly fix the vulnerabilities.
Solution:
The vendor has released version 1.01 of the software. This upgrade version reportedly does not properly fix the vulnerabilities.
References
Centre Online School Software Multiple Vulnerabilities
References:
References:
- [Full-Disclosure] Malicious post by "Manip" (Andrew Schmadeke
- Centre Home Page (The Miller Group)