34 lines
No EOL
1.1 KiB
Text
34 lines
No EOL
1.1 KiB
Text
Vendor/Product: Kunena
|
|
Vulnerable Versions: < 1.5.14; < 1.6.3
|
|
Vulnerability Type: SQL Injection & information leakage
|
|
Risk level: High
|
|
|
|
Vulnerability Details:
|
|
Because parameterized queries were not used, and adequate input
|
|
sanitization was not done on the catids parameter on the advanced search
|
|
page, it is possible for an attacker to run limited SQL commands on the
|
|
server.
|
|
|
|
Furthermore, when exploited with invalid SQL, it provides the full
|
|
stacktrace. This gives the attacker the exact version of Kunena, PHP,
|
|
and MySQL along with path to kunena.search.class.php. This path often
|
|
starts with /home/username which discloses the username, which can then
|
|
be used to launch further attacks. This can not be disabled in the
|
|
1.5.x branch, in 1.6.x branch it can be disabled via "display_errors = off".
|
|
|
|
|
|
Recommendations:
|
|
If using the 1.5.x branch, upgrade to 1.5.14 and consider moving to the
|
|
1.6.x branch.
|
|
If using the 1.6.x branch, upgrade to 1.6.3 and set "display_errors =
|
|
off" to mitigate any damage for potential future issues
|
|
|
|
http://www.kunena.org/download
|
|
|
|
|
|
Proof of Concept:
|
|
http://localhost/index.php/forum/advsearch?q=hilfe&catids=5\%27
|
|
|
|
|
|
Regards,
|
|
Red Matter Inc. |