qliteNews 'loginprocess.php'多个SQL注入漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1195555 漏洞类型 SQL注入
发布时间 2006-03-31 更新时间 2006-04-13
CVE编号 CVE-2006-1571 CNNVD-ID CNNVD-200603-527
漏洞平台 N/A CVSS评分 5.1
|漏洞来源
https://www.securityfocus.com/bid/17333
https://cxsecurity.com/issue/WLB-2006040034
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200603-527
|漏洞详情
qliteNews2005.07.01的loginprocess.php中存在多个SQL注入漏洞,远程攻击者可通过(1)username或(2)password参数,执行任意SQL命令。
|漏洞EXP
New eVuln Advisory:
qliteNews SQL Injection Vulnerability
http://evuln.com/vulns/114/summary.html

--------------------Summary----------------
eVuln ID: EV0114
CVE: CVE-2006-1571
Vendor: r2xDesign.net
Vendor's Web Site: http://www.r2xdesign.net/
Software: qliteNews
Versions: 2005.07.01
Critical Level: Moderate
Type: SQL Injection
Class: Remote
Status: Unpatched. No reply from developer(s)
PoC/Exploit: Available
Solution: Not Available
Discovered by: Aliaksandr Hartsuyeu (eVuln.com)

-----------------Description---------------
Vulnerable script: loginprocess.php

Variables $username, $password are not properly sanitized before being used in SQL query. This can be used to bypass authentication or make any SQL query by injecting arbitrary SQL code.

Condition: magic_quotes_gpc = off

--------------PoC/Exploit----------------------
Available at: http://evuln.com/vulns/114/exploit.html

--------------Solution---------------------
No Patch available.

--------------Credit-----------------------
Discovered by: Aliaksandr Hartsuyeu (eVuln.com)

Regards,
Aliaksandr Hartsuyeu
http://evuln.com - Penetration Testing Services
.
|受影响的产品
r2xDesign qliteNews 2005.07.01
|参考资料

来源:VUPEN
名称:ADV-2006-1182
链接:http://www.frsirt.com/english/advisories/2006/1182
来源:SECUNIA
名称:19476
链接:http://secunia.com/advisories/19476
来源:MISC
链接:http://evuln.com/vulns/114/summary.html
来源:XF
名称:qlitenews-loginprocess-sql-injection(25565)
链接:http://xforce.iss.net/xforce/xfdb/25565
来源:BID
名称:17333
链接:http://www.securityfocus.com/bid/17333
来源:BUGTRAQ
名称:20060413[eVuln]qliteNewsSQLInjectionVulnerability
链接:http://www.securityfocus.com/archive/1/archive/1/430873/100/0/threaded
来源:OSVDB
名称:24301
链接:http://www.osvdb.org/24301
来源:SREASON
名称:701
链接:http://securityreason.com/securityalert/701