From: SecuriTeam <support@securiteam.com.>
To: [email protected]
Date: 22 Feb 2005 15:58:10 +0200
Subject: [UNIX] SQL Injection in CitrusDB
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-Id: <20050222144927.8E0F257E1@mail.tyumen.ru.>
X-Virus-Scanned: antivirus-gw at tyumen.ru
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
SQL Injection in CitrusDB
------------------------------------------------------------------------
SUMMARY
" <http://www.citrusdb.org/>; CitrusDB is an open source customer database
application that uses PHP and a database backend (currently MySQL) to keep
track of customer information, services, products, billing, and customer
service information. The program will run on any PHP enabled web server."
CitrusDB contains a vulnerability that allows a remote attacker to
initiate an SQL injection vulnerability by uploading a malicious CSV file.
DETAILS
Vulnerable Systems:
* CitrusDB version 0.3.6 and prior
CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0410>;
CAN-2005-0410
CitrusDB does not filter special characters (e.g. single quotes) from
uploaded CSV files. In the file ./citrusdb/tools/importcc.php the data
from a previous uploaded CSV file is inserted into the MySQL database but
none of the values are filtered.
Proof of Concept:
A CSV file containing single quotes ('), makes the SQL Query found in
/citrusdb/tools/importcc.php to fail.
Disclosure Timeline:
2005-02-04 Vendor notified
2005-02-12 CVE number requested
2005-02-14 CVE number obtained (CAN-2005-0410)
ADDITIONAL INFORMATION
The information has been provided by
<mailto:dornseif@informatik.rwth-aachen.de.> Maximillian Dornseif.
The original article can be found at:
<http://tsyklon.informatik.rwth-aachen.de/redteam/advisories/rt-sa-2005-004>; http://tsyklon.informatik.rwth-aachen.de/redteam/advisories/rt-sa-2005-004
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected]
In order to subscribe to the mailing list, simply forward this email to: [email protected]
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
