|
|
|
|
| |
Credit:
The information has been provided by Secunia Research.
The original article can be found at: http://secunia.com/secunia_research/2006-43/advisory/
|
| |
Vulnerable Systems:
* CMS Mundo version 1.0 build 007
Immune Systems:
* CMS Mundo version 1.0 build 008
1) Input passed to the "username" parameter in "controlpanel/" during login isn't properly sanitised before being used in a
SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
This can further be exploited to bypass the authentication process and access the administration section (by e.g. providing
"admin ' /*" as the username together with an empty password).
Successful exploitation requires that "magic_quotes_gpc" is disabled.
2) An input validation error in the image upload handling in the image gallery can be exploited to upload arbitrary PHP scripts to a predictable location inside the web root.
Successful exploitation requires access to the administration section.
A combination of vulnerabilities #1 and #2 can be exploited by a malicious person to execute arbitrary PHP code on a vulnerable system.
The vulnerabilities have been confirmed in version 1.0 build 007. Prior versions may also be affected.
Solution:
Update to version 1.0 build 008.
Time Table:
30/05/2006 - Initial vendor notification.
30/05/2006 - Vendor confirms vulnerabilities.
14/06/2006 - Public disclosure.
CVE Information:
CVE-2006-2911,
CVE-2006-2931
|
|
|
|
|
