PHP-Fusion Database Backup Information Disclosure Vulnerability
BID:10974
Info
PHP-Fusion Database Backup Information Disclosure Vulnerability
| Bugtraq ID: | 10974 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 18 2004 12:00AM |
| Updated: | Aug 18 2004 12:00AM |
| Credit: | Ahmad Muammar <[email protected]> disclosed this vulnerability. |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
PHP-Fusion Database Backup Information Disclosure Vulnerability
It is reported that PHP-Fusion is susceptible to a database backup information disclosure vulnerability. An anonymous remote attacker may be able to download a complete database backup from the server. Authentication would not be required.
A remote attacker may exploit this vulnerability to download the full contents of the application database. The backup includes user information and password hashes. This information could then be used in further attacks against the application. Furthermore, since the database uses the MD5 hash of passwords for authentication, and the authentication cookie directly includes both the username and the MD5 password hash, an attacker would not need to bruteforce the retrieved password hashes.
Version 4.00 was reported vulnerable. Other versions are also likely affected.
Update:
This issue is being retired due to the fact that this is not a vulnerability in the application. Configuring the Web server to restrict access to sensitive files can prevent this problem.
It is reported that PHP-Fusion is susceptible to a database backup information disclosure vulnerability. An anonymous remote attacker may be able to download a complete database backup from the server. Authentication would not be required.
A remote attacker may exploit this vulnerability to download the full contents of the application database. The backup includes user information and password hashes. This information could then be used in further attacks against the application. Furthermore, since the database uses the MD5 hash of passwords for authentication, and the authentication cookie directly includes both the username and the MD5 password hash, an attacker would not need to bruteforce the retrieved password hashes.
Version 4.00 was reported vulnerable. Other versions are also likely affected.
Update:
This issue is being retired due to the fact that this is not a vulnerability in the application. Configuring the Web server to restrict access to sensitive files can prevent this problem.
Exploit / POC
PHP-Fusion Database Backup Information Disclosure Vulnerability
An exploit is not required. An example URI that points to a database backup was provided:
http://www.example.com/fusion/fusion_admin/db_backups/backup_2004-08-17_1845.sql
An exploit is not required. An example URI that points to a database backup was provided:
http://www.example.com/fusion/fusion_admin/db_backups/backup_2004-08-17_1845.sql
Solution / Fix
PHP-Fusion Database Backup Information Disclosure Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
PHP-Fusion Database Backup Information Disclosure Vulnerability
References:
References: