Bugtraq mailing list archives
Multiple vulnerabilities in XAMPP (advisories #3 and #4)
From: "MustLive" <mustlive () websecurity com ua>
Date: Fri, 29 Jan 2010 01:39:37 +0200
Hello Bugtraq! I am continue informing you about multiple vulnerabilities in XAMPP. ----------------------------- Advisory #3 ----------------------------- Vulnerabilities in XAMPP ----------------------------- URL: http://websecurity.com.ua/3233/ ----------------------------- Timeline: 11.06.2009 - found the vulnerabilities. 15.06.2009 - announced at my site. 16.06.2009 - informed developers. 21.07.2009 - disclosed at my site. ----------------------------- Details: These are Insufficient Authentication, Cross-Site Scripting and SQL Injection vulnerabilities. Insufficient Authentication: http://site/xampp/ There are such sites, where access to admin panel of XAMPP is not restricted by password. XSS: POST query at page http://site/xampp/adodb.php "><script>alert(document.cookie)</script> In fields: Database server, Host, Username, Password, Current database, Selected table. SQL Injection: Attack is conducted during access to admin panel of XAMPP - via above-mentioned Insufficient Authorization vulnerability or via Insufficient Authorization vulnerability which was found earlier, which I wrote about (http://websecurity.com.ua/3220/). At page http://site/xampp/adodb.php cds where 1=0 union select version(),0,0,0 In field Selected table. Vulnerable are XAMPP 1.6.8 and previous versions. And potentially next versions (including last version XAMPP 1.7.1). ----------------------------- Advisory #4 ----------------------------- Vulnerabilities in XAMPP ----------------------------- URL: http://websecurity.com.ua/3250/ ----------------------------- Timeline: 11.06.2009 - found the vulnerabilities. 20.06.2009 - announced at my site. 21.06.2009 - informed developers. 25.07.2009 - disclosed at my site. ----------------------------- Details: These are Information Leakage, Cross-Site Request Forgery and SQL Injection vulnerabilities. Information Leakage: http://site/xampp/phpinfo.php During access to admin panel (via Insufficient Authorization vulnerabilities) it's possible to gain a lot of information about the system. CSRF: http://site/xampp/cds.php It's possible to delete or add data in test table (as via CSRF, and as via Insufficient Authorization vulnerabilities). And also to conduct SQL Injection via CSRF attacks. SQL Injection: http://site/xampp/cds.php?action=del&id=-1%20or%201=1 http://site/xampp/cds.php?interpret=1&titel=1&jahr=1),(version(),1,1 http://site/xampp/cds.php?interpret=1&titel=',1,1),(version(),1,1)/* (mq off) http://site/xampp/cds.php?titel=1&interpret=',1),(version(),1,1)/** (mq off) Attack is possible during access to admin panel (via Insufficient Authorization), or via CSRF. Vulnerable are XAMPP 1.6.8 and previous versions. And potentially next versions (including last version XAMPP 1.7.1). ----------------------------- Best wishes & regards, MustLive Administrator of Websecurity web sitehttp://websecurity.com.ua
Current thread:
- Multiple vulnerabilities in XAMPP (advisories #3 and #4) MustLive (Jan 29)