Full Disclosure mailing list archives
Security Advisory: SQL injection in PhpWebSite <= 0.10.1
From: Kevin Wilcox <kevin () tux appstate edu>
Date: Wed, 12 Oct 2005 15:01:30 -0400
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ======================================================================== phpWebSite Security Advisory phpwebsite_security () tux appstate edu http://phpwebsite.appstate.edu Kevin Wilcox 12 October 2005 ======================================================================== Type: SQL Injection Versions Affected: <= 0.10.1 Description: phpWebSite is an open source Content Management System released by Electronic Student Services at Appalachian State University. At 930 EST the phpWebSite development team was made aware that, using a flaw in the Search module, an attacker was able to gain access to approximately ten user names and hashed passwords using URLs formatted in the following fashion: http://SITE_NAME/index.php?module='+UNION+select+username,username+from+mod_users+where+user_id='1'/* http://SITE_NAME/index.php?module='+UNION+select+username,password+from+mod_users+where+user_id='1'/* Only versions 0.10.1 and earlier are affected. The current stable release, 0.10.2, and the latest development release, fallout, are not susceptible. Patch Status: A patch was released approximately 90 minutes after the development team was made aware of the flaw. The patch is available from sourceforge: http://osdn.dl.sourceforge.net/sourceforge/phpwebsite/phpwebsite_security_patch_20051202.tgz and on the phpwebsite main page: http://phpwebsite.appstate.edu -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.6 (GNU/Linux) iD8DBQFDTV2I7XWNuvsOTiYRApfTAKCY1mFj3M5aJeQfsInfZsaUlL1mbwCfUJ+T 0p6mgP5bN7fqnahc08CFDI4= =NNaS -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Security Advisory: SQL injection in PhpWebSite <= 0.10.1 Kevin Wilcox (Oct 12)