Mambo Open Source Multiple SQL Injection Vulnerabilities
BID:16775
Info
Mambo Open Source Multiple SQL Injection Vulnerabilities
| Bugtraq ID: | 16775 |
| Class: | Input Validation Error |
| CVE: |
CVE-2006-1794 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 21 2006 12:00AM |
| Updated: | Mar 19 2015 09:29AM |
| Credit: | Discovered by GulfTech Research And Development. |
| Vulnerable: |
Mambo Mambo Open Source 4.5.3 Mambo Mambo Open Source 4.5.2 .3 Mambo Mambo Open Source 4.5.2 .2 Mambo Mambo Open Source 4.5.2 .1 Mambo Mambo Open Source 4.5.2 Mambo Mambo Open Source 4.5.1 (1.0.9) Mambo Mambo Open Source 4.5.1 Beta 2 Mambo Mambo Open Source 4.5.1 Beta Mambo Mambo Open Source 4.5.1 Mambo Mambo Open Source 4.5 (1.0.3beta) Mambo Mambo Open Source 4.5 (1.0.3) Mambo Mambo Open Source 4.5 (1.0.2) Mambo Mambo Open Source 4.5 (1.0.1) Mambo Mambo Open Source 4.5 (1.0.0) Mambo Mambo Open Source 4.0.14 Mambo Mambo Open Source 4.5.3h |
| Not Vulnerable: | |
Discussion
Mambo Open Source Multiple SQL Injection Vulnerabilities
Mambo is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
Mambo is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
Exploit / POC
Mambo Open Source Multiple SQL Injection Vulnerabilities
These issues can be exploited with a web client.
The following proof of concept URI is available:
http://www.example.com/mambo/index2.php?option=com_content&task=-99'%20UNION%20SELECT%201%20FROM%20mos_users%20WHERE%20username='admin'%20AND%20MID(password,1,1)='2'/*&id=24&Itemid=0
These issues can be exploited with a web client.
The following proof of concept URI is available:
http://www.example.com/mambo/index2.php?option=com_content&task=-99'%20UNION%20SELECT%201%20FROM%20mos_users%20WHERE%20username='admin'%20AND%20MID(password,1,1)='2'/*&id=24&Itemid=0
Solution / Fix
Mambo Open Source Multiple SQL Injection Vulnerabilities
Solution:
The vendor has released patches for versions 4.5.3 and 4.5.3h to address this issue.
Mambo Mambo Open Source 4.5.3h
Mambo Mambo Open Source 4.5.3
Solution:
The vendor has released patches for versions 4.5.3 and 4.5.3h to address this issue.
Mambo Mambo Open Source 4.5.3h
-
Mambo MamboV4.5.3h_SecurityPatch1.tar.gz
http://mamboxchange.com/frs/download.php/7370/MamboV4.5.3h_SecurityPat ch1.tar.gz
Mambo Mambo Open Source 4.5.3
-
Mambo MamboV4.5.3_SecurityPatch1.tar.gz
http://mamboxchange.com/frs/download.php/7373/MamboV4.5.3_SecurityPatc h1.tar.gz
References
Mambo Open Source Multiple SQL Injection Vulnerabilities
References:
References:
- Mambo Multiple Vulnerabilities (GuflTech Research)
- Mambo Open Source Homepage (Mambo)
- Mambo Security Announcement (Mambo)