[prev in list] [next in list] [prev in thread] [next in thread]
List: full-disclosure
Subject: [FD] [KIS-2014-11] TestLink <= 1.9.12 (execSetResults.php) PHP Object Injection Vulnerability
From: Egidio Romano <research () karmainsecurity ! com>
Date: 2014-10-23 21:08:14
Message-ID: 54496E3E.8070502 () karmainsecurity ! com
[Download RAW message or body]
--------------------------------------------------------------------------
TestLink <= 1.9.12 (execSetResults.php) PHP Object Injection Vulnerability
--------------------------------------------------------------------------
[-] Software Link:
http://testlink.org/
[-] Affected Versions:
Version 1.9.12 and prior versions.
[-] Weakness Description:
The vulnerable code is located in the /lib/execute/execSetResults.php script:
428. if(is_string($args->filter_status) && strlen($args->filter_status) > 1)
429. {
430. $args->filter_status = unserialize($args->filter_status);
431. }
User input passed through the “filter_result_result” request parameter is not properly \
sanitized before being used in a call to the “unserialize()” function at line 430. This can be \
exploited to inject arbitrary PHP objects into the application scope, and could allow an \
attacker to delete arbitrary files, carry out Server-Side Request Forgery (SSRF), SQL \
Injection, or Local/Remote File Inclusion attacks via specially crafted serialized objects.
[-] Solution:
Update to version 1.9.13 when will be released or apply these hotfixes: \
http://mantis.testlink.org/view.php?id=6609
[-] Disclosure Timeline:
[06/10/2014] - Issue reported to http://mantis.testlink.org/view.php?id=6651
[07/10/2014] - Issue fixed in the Git repository: http://goo.gl/ptQaqZ
[08/10/2014] - CVE number requested
[11/10/2014] - CVE number assigned
[23/10/2014] - Public disclosure
[-] CVE Reference:
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2014-8081 to this vulnerability.
[-] Credits:
Vulnerability discovered by Egidio Romano.
[-] Original Advisory:
http://karmainsecurity.com/KIS-2014-11
_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic