Secunia Research: ADOdb Insecure Test Scripts Security Issues

[Secunia Research <vuln () secunia com>]

======================================================================

                     Secunia Research 09/01/2006

            - ADOdb Insecure Test Scripts Security Issues -

======================================================================
Table of Contents

Affected Software....................................................1
Severity.............................................................2
Vendor's Description of Software.....................................3
Description of Security Issues.......................................4
Solution.............................................................5
Time Table...........................................................6
Credits..............................................................7
About Secunia........................................................8
Verification.........................................................9

======================================================================
1) Affected Software

ADOdb versions 4.66 and 4.68 for PHP

The following applications have been confirmed to insecurely bundle 
test scripts for the ADOdb library:
* Mantis versions 0.19.4 and 1.0.0rc4
* PostNuke version 0.761 (only security issue #1)
* Moodle version 1.5.3
* Cacti version 0.8.6g (only security issue #1)

Other versions may also be affected.

======================================================================
2) Severity

Rating: Less critical
Impact: System access
        Exposure of system information
        Security bypass
Where:  Remote

======================================================================
3) Vendor's Description of Software

ADOdb is a database abstraction library for PHP.

Product link:
http://adodb.sourceforge.net/

======================================================================
4) Description of Security Issues

Secunia Research has discovered two security issues in ADOdb, which 
can be exploited by malicious people to disclose system information, 
execute arbitrary SQL code, and potentially compromise a vulnerable 
system.

1) The problem is caused due to the presence of the insecure 
"server.php" test script. This can be exploited to execute arbitrary 
SQL code with full MySQL database privileges via the "sql" parameter.

Example:
http://[victim]/server.php?sql=SELECT '[content]' INTO OUTFILE '[file]'

This can further be exploited to create an arbitrary PHP script in a 
directory inside the web root writable by the MySQL user.

Successful exploitation requires that the MySQL password for the root 
user is empty and that the affected script is placed accessible 
inside the web root.

2) The problem is caused due to the presence of the insecure 
"tests/tmssql.php" test script. This can be exploited to call an 
arbitrary PHP function via the "do" parameter.

Example:
http://[victim]/tests/tmssql.php?do=phpinfo

Successful exploitation requires that the affected script is placed 
accessible inside the web root.

The security issues have been confirmed in versions 4.66 and 4.68 for 
PHP. Other versions may also be affected.

======================================================================
5) Solution

ADOdb:
Update to version 4.70 for PHP.
http://sourceforge.net/project/showfiles.php?group_id=42718

Mantis:
Restrict web access to PHP scripts in the "core/adodb" directory 
(e.g. with a .htaccess file).

PostNuke:
Update to version 0.761a.
http://downloads.postnuke.com/

Moodle:
The security issues have been fixed in the latest stable branch 
(Moodle 1.5.3 +).

Cacti:
Update to version 0.8.6h.
http://www.cacti.net/download_cacti.php

======================================================================
6) Time Table

30/12/2005 - Initial vendor notification.
03/01/2006 - Other affected vendors notified.
05/01/2006 - Initial vendor reply.
08/01/2006 - New version of ADOdb released.
09/01/2006 - Public disclosure.

======================================================================
7) Credits

Discovered by Andreas Sandblad, Secunia Research.

======================================================================
8) About Secunia

Secunia collects, validates, assesses, and writes advisories regarding
all the latest software vulnerabilities disclosed to the public. These
advisories are gathered in a publicly available database at the
Secunia website:

http://secunia.com/

Secunia offers services to our customers enabling them to receive all
relevant vulnerability information to their specific system
configuration.

Secunia offers a FREE mailing list called Secunia Security Advisories:

http://secunia.com/secunia_security_advisories/

======================================================================
9) Verification

Please verify this advisory by visiting the Secunia website:
http://secunia.com/secunia_research/2005-64/advisory/

Complete list of vulnerability reports published by Secunia Research:
http://secunia.com/secunia_research/

======================================================================

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/