XeoPort 'Index.PHP' SQL注入漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1193209 漏洞类型 SQL注入
发布时间 2006-10-13 更新时间 2006-10-19
CVE编号 CVE-2006-5285 CNNVD-ID CNNVD-200610-210
漏洞平台 N/A CVSS评分 7.5
|漏洞来源
https://cxsecurity.com/issue/WLB-2006100099
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200610-210
|漏洞详情
XeoPort0.81及可能早期版本的index.php脚本存在SQL注入漏洞,远程攻击者可借助xp_body_text参数执行任意SQL命令。
|漏洞EXP
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
 
      Advisory: XeoPort <= 0.81 SQL Injection Vulnerability
  Release Date: 10/12/2006
 Last Modified: 10/12/2006
        Author: Tamriel [tamriel at gmx dot net]
   Application: XeoPort <= 0.81
          Risk: Moderate
 Vendor Status: not contacted
   Vendor Site: www.xeoman.com | www.xeoman.de

Overview:

Quote from www.xeoman.de:

"XeoPort imports emails from an IMAP or POP3 server into
   your MySQL database. The text part and/ or the entire message
   will be imported. An elegant way for Outlook Express users
   (like me) to extract messages from Microsofts proprietary
   binary format. I tried Access via Outlook but it turned out
   to be buggy all the way. The additional script show.php
   (folder goodie) uses Outlook Express to display the entire
   message if you want to get your hands on attached files. It
   can be used to dump the entire MySQL database back into Outlook
   Express messages providing kind of a backup."

There are is a SQL injection vulnerability which can be
      exploited by malicious people to conduct SQL injection attacks.

The vulnerability has been discovered in the latest version,
      0.81. Other versions may also be affected.

Details:
 
      SQL Injection in index.php

The Input `$xp_body_text` parameter isn't properly sanitised
      before being used in a SQL query.
      
      An attacker must send an Email with 7bit encoding to perform
      this attack.
      
      Some other variables may also be affected.

Proof of Concept:

Not needed

Solution/Fix:

You must have register_globals enabled to run this script,
      disable it and edit the source code to ensure that input is
      properly sanitised and change all input variables.

Use functions like PHP's htmlentities() and
      mysql_real_escape_string() functions.

Disclosure Timeline:

10/12/2006 - Discovery of the vulnerabilities
      10/12/2006 - Public disclosure
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (MingW32)
 
iD8DBQFFLbRdqBhP+Twks7oRCgsRAKCGPWGfNMIiC2oU7rX4ti4gKWxqEgCglwZH
CmdsPUHCLdgYlBjmFzk2Sz4=
=1cU+
-----END PGP SIGNATURE-----
|参考资料

来源:BID
名称:20475Hyperlink:http://www.securityfocus.com/bid/20475
来源:BUGTRAQ
名称:20061012XeoPort<=0.81SQLInjectionVulnerabilityHyperlink:http://www.securityfocus.com/archive/1/archive/1/448424/100/0/threaded
来源:FULLDISC
名称:20061012XeoPort<=0.81SQLInjectionVulnerabilityHyperlink:http://marc.theaimsgroup.com/?l=full-disclosure&m=116062269104422&w=2
来源:XF
名称:xeoport-index-sql-injection(29479)Hyperlink:http://xforce.iss.net/xforce/xfdb/29479
来源:SECTRACK
名称:1017055Hyperlink:http://securitytracker.com/id?1017055
来源:SREASON
名称:1735Hyperlink:http://securityreason.com/securityalert/1735