Date: Thu, 1 Dec 2005 22:50:37 +0100
From: David Maciejak <david.maciejak@kyxar.fr.>
To: [email protected]Subject: Edgewall Trac SQL Injection Vulnerability
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
User-Agent: Internet Messaging Program (IMP) 3.1
X-Originating-IP: 82.230.147.27
X-Virus-Scanned: antivirus-gw at tyumen.ru
Edgewall Trac SQL Injection Vulnerability
Trac is an enhanced wiki and issue tracking system
for software development project. It provides an
interface to Subversion.
More information on http://projects.edgewall.com/trac/
Description:
Malicious user can conduct SQL injection in ticket query module
because supplied 'group' URI data passed to the query script
is not properly sanitized.
PoC:
http://host/trac/query?group=/*
Vulnerable version:
Version tested is 0.9
Maybe 0.9 betas are also vulnerable
Solution:
Upgrade to version 0.9.1
http://projects.edgewall.com/trac/wiki/TracDownload
Thanks for the quick fix of the Trac Team !
David Maciejak
--------------------------------------------------------------------------------
KYXAR.FR - Mail envoyИ depuis http://webmail.kyxar.fr
