Mahara Multiple Remote Vulnerabilities
BID:41319
Info
Mahara Multiple Remote Vulnerabilities
| Bugtraq ID: | 41319 |
| Class: | Unknown |
| CVE: |
CVE-2010-1667 CVE-2010-1668 CVE-2010-1669 CVE-2010-1670 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 02 2010 12:00AM |
| Updated: | Jul 02 2010 06:57PM |
| Credit: | Reported by the vendor |
| Vulnerable: |
Mahara Mahara 1.2.4 Mahara Mahara 1.2.3 Mahara Mahara 1.1.8 Mahara Mahara 1.1.7 Mahara Mahara 1.1.6 Mahara Mahara 1.1.5 Mahara Mahara 1.1.4 Mahara Mahara 1.1.3 Mahara Mahara 1.1.2 Mahara Mahara 1.1.1 Mahara Mahara 1.0.14 Mahara Mahara 1.0.13 Mahara Mahara 1.0.12 Mahara Mahara 1.0.11 Mahara Mahara 1.0.10 Mahara Mahara 1.0.9 Mahara Mahara 1.0.8 Mahara Mahara 1.0.6 Mahara Mahara 1.0.5 Mahara Mahara 1.0.4 Mahara Mahara 1.0.3 Mahara Mahara 1.0.2 Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 |
| Not Vulnerable: |
Mahara Mahara 1.2.5 Mahara Mahara 1.1.9 Mahara Mahara 1.0.15 |
Discussion
Mahara Multiple Remote Vulnerabilities
Mahara is prone to multiple remote vulnerabilities, including:
1. Multiple HTML-injection vulnerabilities
2. A cross-site request-forgery vulnerability
3. Multiple SQL-injection vulnerabilities
4. An authentication-bypass vulnerability
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database, gain unauthorized access to the application and perform certain administrative tasks.
Mahara is prone to multiple remote vulnerabilities, including:
1. Multiple HTML-injection vulnerabilities
2. A cross-site request-forgery vulnerability
3. Multiple SQL-injection vulnerabilities
4. An authentication-bypass vulnerability
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database, gain unauthorized access to the application and perform certain administrative tasks.
Exploit / POC
Mahara Multiple Remote Vulnerabilities
An attacker can exploit these issues through a browser. To exploit a cross-site request-forgery issue, the attacker must entice an unsuspecting victim to follow a malicious URI.
An attacker can exploit these issues through a browser. To exploit a cross-site request-forgery issue, the attacker must entice an unsuspecting victim to follow a malicious URI.
References
Mahara Multiple Remote Vulnerabilities
References:
References:
- Mahara 1.0.15 Release Notes (Mahara)
- Mahara 1.1.9 Release Notes (Mahara)
- Mahara 1.2.5 Release Notes (Mahara)
- Mahara Homepage (Mahara)