vTiger CRM 多个SQL注入漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1109298 漏洞类型 SQL注入
发布时间 2005-11-24 更新时间 2005-11-28
CVE编号 CVE-2005-3819 CNNVD-ID CNNVD-200511-402
漏洞平台 PHP CVSS评分 7.5
|漏洞来源
https://www.exploit-db.com/exploits/26586
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200511-402
|漏洞详情
VtigerCRM是美国Vtiger公司的一套基于SugarCRM开发的客户关系管理系统(CRM)。该管理系统提供管理、收集、分析客户信息等功能。vTigerCRM4.2及更早的版本中存在多个SQL注入漏洞,这允许远程攻击者可以通过以下方式注入任意SQL命令并绕过认证:HelpDesk模块中的(1)user_name和(2)date参数。
|漏洞EXP
source: http://www.securityfocus.com/bid/15562/info
  
vtiger CRM is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
  
vTiger CRM is prone to multiple SQL injection, HTML injection, cross-site scripting and local file include vulnerabilities.
  
An attacker can exploit these issues to gain administrative access, retrieve username and password pairs, steal cookie-based authentication credentials and retrieve arbitrary local files in the context of the Web server process; other attacks are also possible.
  
Some of these issues may be related to those discussed in BID 11740 (SugarCRM Multiple Input Validation Vulnerabilities) discovered by James Bercegay and Damon Wood of the GulfTech Security Research Team, as vtiger is a fork of the SugarCRM project.
  
An independent study by Daniel Fabian of SEC-CONSULT has confirmed the existence of several of these issues. Please see the referenced advisory for more information. 

http://www.example.com/?ticket_title=&contact_name=&priority=&status=&action=index&query=true&module=HelpDesk&order_by=&sorder=ASC&viewname=0&button=Search&category=&date_crit=is&date=%27+UNION+SELECT+56%2CCONCAT%28user_name%2C+%22%3A%22%2C+user_password%29%2C+%22Open%22%2C%22Normal%22%2C1%2C1%2C1%2C1%2C1%2C1%2C1%2C1+from+users+where+users.user_name+LIKE+%27
|参考资料

来源:BID
名称:15562
链接:http://www.securityfocus.com/bid/15562
来源:BUGTRAQ
名称:20051124Advisory23/2005:vTigermultiplevulnerabilities
链接:http://www.securityfocus.com/archive/1/archive/1/417730/30/0/threaded
来源:MISC
链接:http://www.hardened-php.net/advisory_232005.105.html
来源:VUPEN
名称:ADV-2005-2569
链接:http://www.frsirt.com/english/advisories/2005/2569
来源:SECUNIA
名称:17693
链接:http://secunia.com/advisories/17693
来源:OSVDB
名称:21225
链接:http://www.osvdb.org/21225
来源:SECTRACK
名称:1015271
链接:http://securitytracker.com/id?1015271