MyDMS SQL Injection Vulnerability And Directory Traversal Vulnerability
BID:10996
Info
MyDMS SQL Injection Vulnerability And Directory Traversal Vulnerability
| Bugtraq ID: | 10996 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 21 2004 12:00AM |
| Updated: | Aug 21 2004 12:00AM |
| Credit: | Jose Antonio <[email protected]> disclosed these vulnerabilities. |
| Vulnerable: |
MyDMS MyDMS 1.4.2 MyDMS MyDMS 1.4.1 MyDMS MyDMS 1.4 |
| Not Vulnerable: |
MyDMS MyDMS 1.4.3 |
Discussion
MyDMS SQL Injection Vulnerability And Directory Traversal Vulnerability
MyDMS is reportedly susceptible to both a directory traversal vulnerability and an SQL injection vulnerability.
The SQL injection vulnerability is present because a script improperly sanitizes user-supplied data located in a URI argument before using the value in an SQL statement.
Successful exploitation of the SQL injection vulnerability could result in compromise of the application, disclosure or modification of data or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
The directory traversal vulnerability reportedly allows registered users to download arbitrary web server readable files from the hosting computer. This is due to a failure of the application to properly sanitize user-supplied input data consisting of '../' directory traversal sequences.
Successful exploitation of the directory traversal vulnerability could result in an attacker gaining access to the contents of potentially sensitive files on the hosting computer. This may aid them in further attacks against the host computer.
The SQL injection is reportedly fixed in version 1.4.2. Versions prior to this are reported to be susceptible. The directory traversal vulnerability is fixed in version 1.4.3.
MyDMS is reportedly susceptible to both a directory traversal vulnerability and an SQL injection vulnerability.
The SQL injection vulnerability is present because a script improperly sanitizes user-supplied data located in a URI argument before using the value in an SQL statement.
Successful exploitation of the SQL injection vulnerability could result in compromise of the application, disclosure or modification of data or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
The directory traversal vulnerability reportedly allows registered users to download arbitrary web server readable files from the hosting computer. This is due to a failure of the application to properly sanitize user-supplied input data consisting of '../' directory traversal sequences.
Successful exploitation of the directory traversal vulnerability could result in an attacker gaining access to the contents of potentially sensitive files on the hosting computer. This may aid them in further attacks against the host computer.
The SQL injection is reportedly fixed in version 1.4.2. Versions prior to this are reported to be susceptible. The directory traversal vulnerability is fixed in version 1.4.3.
Exploit / POC
MyDMS SQL Injection Vulnerability And Directory Traversal Vulnerability
An exploit is not required. An example URI sufficient to exploit the SQL injection vulnerability was provided:
http://www.example.com/demo/out/out.ViewFolder.php?folderid=3 or 1=1
An example for the directory traversal vulnerability:
http://www.example.com/mydms/op/op.ViewOnline.php?request=4:6:/../../../../../etc/passwd
An exploit is not required. An example URI sufficient to exploit the SQL injection vulnerability was provided:
http://www.example.com/demo/out/out.ViewFolder.php?folderid=3 or 1=1
An example for the directory traversal vulnerability:
http://www.example.com/mydms/op/op.ViewOnline.php?request=4:6:/../../../../../etc/passwd
Solution / Fix
MyDMS SQL Injection Vulnerability And Directory Traversal Vulnerability
Solution:
The vendor has released version 1.4.3 to address these issues:
MyDMS MyDMS 1.4
MyDMS MyDMS 1.4.1
MyDMS MyDMS 1.4.2
Solution:
The vendor has released version 1.4.3 to address these issues:
MyDMS MyDMS 1.4
-
MyDMS mydms-1.4.3.tar.gz
http://dms.markuswestphal.de/download.php?path=archives&filename=mydms -1.4.3.tar.gz
MyDMS MyDMS 1.4.1
-
MyDMS mydms-1.4.3.tar.gz
http://dms.markuswestphal.de/download.php?path=archives&filename=mydms -1.4.3.tar.gz
MyDMS MyDMS 1.4.2
-
MyDMS mydms-1.4.3.tar.gz
http://dms.markuswestphal.de/download.php?path=archives&filename=mydms -1.4.3.tar.gz
References
MyDMS SQL Injection Vulnerability And Directory Traversal Vulnerability
References:
References:
- MyDMS Home Page (MyDMS)
- Bugs fixed in Version 1.4.3 (Joxean Koret
- Multiple vulnerabilities in MyDMS (Jose Antonio