Multiple HiveMail Vulnerabilities
BID:16591
Info
Multiple HiveMail Vulnerabilities
| Bugtraq ID: | 16591 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 11 2006 12:00AM |
| Updated: | Feb 13 2006 04:58PM |
| Credit: | Discovery is credited to GulfTech Security Research. |
| Vulnerable: |
HiveMail HiveMail 1.2.2 HiveMail HiveMail 1.3 RC1 HiveMail HiveMail 1.3 Beta 1 HiveMail HiveMail 1.3 |
| Not Vulnerable: | |
Discussion
Multiple HiveMail Vulnerabilities
HiveMail is prone to multiple vulnerabilities. These vulnerabilities may allow the execution of arbitrary PHP code, cross-site scripting attacks, and SQL injection.
The PHP code-execution issues are the result of an input-validation error that may allow user-supplied PHP code to be evaluated by the interpreter.
The cross-site scripting vulnerabilities may permit a remote attacker to steal cookie-based authentication credentials from legitimate users.
The SQL-injection issues are the result of the application's failure to properly sanitize user-supplied input that will be included in SQL queries. Successful exploitation of SQL-injection vulnerabilities could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
HiveMail is prone to multiple vulnerabilities. These vulnerabilities may allow the execution of arbitrary PHP code, cross-site scripting attacks, and SQL injection.
The PHP code-execution issues are the result of an input-validation error that may allow user-supplied PHP code to be evaluated by the interpreter.
The cross-site scripting vulnerabilities may permit a remote attacker to steal cookie-based authentication credentials from legitimate users.
The SQL-injection issues are the result of the application's failure to properly sanitize user-supplied input that will be included in SQL queries. Successful exploitation of SQL-injection vulnerabilities could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
Exploit / POC
Multiple HiveMail Vulnerabilities
The following examples have been provided:
http:///www.example.com/addressbook.update.phpcmd=remove&contactgroupid=1%20--%20");phpinfo();@ob_start("&submit=1&contactcheck[]=1&con
tactcheck[]=2
http://www.example.com/addressbook.add.php?cmd=quick&messageid=1");phpinfo();@ob_start("&popid=1&msgid=1
http://www.example.com/folders.update.php?cmd=mark&folderid=0%20--%20%22);phpinfo();@ob_start(%22
http://www.example.com/index.php/%22%3E%3Cscript%3Ealert(document.cookie);%3C/script%3E
The following examples have been provided:
http:///www.example.com/addressbook.update.phpcmd=remove&contactgroupid=1%20--%20");phpinfo();@ob_start("&submit=1&contactcheck[]=1&con
tactcheck[]=2
http://www.example.com/addressbook.add.php?cmd=quick&messageid=1");phpinfo();@ob_start("&popid=1&msgid=1
http://www.example.com/folders.update.php?cmd=mark&folderid=0%20--%20%22);phpinfo();@ob_start(%22
http://www.example.com/index.php/%22%3E%3Cscript%3Ealert(document.cookie);%3C/script%3E
Solution / Fix
Multiple HiveMail Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Multiple HiveMail Vulnerabilities
References:
References:
- HiveMail Homepage (HiveMail)
- HiveMail <= 1.3 Multiple Vulnerabilities (GulfTech Security Research