Mapbender 'mod_gazetteer_edit.php' SQL Injection Vulnerability

Bugtraq ID:	28193
Class:	Input Validation Error
CVE:	CVE-2008-0301
Remote:	Yes
Local:	No
Published:	Mar 11 2008 12:00AM
Updated:	Mar 12 2008 06:31PM
Credit:	RedTeam Pentesting is credited with the discovery of this vulnerability.
Vulnerable:	Mapbender Mapbender 2.4.4
Not Vulnerable:	Mapbender Mapbender 2.4.5 rc1

Mapbender 'mod_gazetteer_edit.php' SQL Injection Vulnerability

Mapbender is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Versions prior to Mapbender 2.4.5 rc1 are vulnerable.

Mapbender 'mod_gazetteer_edit.php' SQL Injection Vulnerability

Attackers can use a browser to exploit this issue.

The following proof-of-concept URI is available:

http://www.example.com/php/mod_gazetteer_edit.php?gaz= 1 LIMIT 0 UNION(SELECT char(65), char(65), char(65), char(65), char(65), char(65),mb_user_name, char(65), mb_user_password, char(65) from mb_userLIMIT 0,1)

Mapbender 'mod_gazetteer_edit.php' SQL Injection Vulnerability

Solution:
The vendor released Mapbender 2.4.5 rc1 to address this issue. Please see the references for more information.


Mapbender Mapbender 2.4.4

• Mapbender mapbender_2.4.5_rc1.zip
  http://www.mapbender.org/download/mapbender_2.4.5_rc1.zip

Mapbender 'mod_gazetteer_edit.php' SQL Injection Vulnerability

References:

• Advisory: SQL-Injections in Mapbender (RedTeam Pentesting)
  
• Mapbender Homepage (Mapbender)
  
• Advisory: SQL-Injections in Mapbender (RedTeam Pentesting GmbH )