Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Tue, 25 Oct 2011 09:12:07 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
CC: Vincent Danen <vdanen@...hat.com>
Subject: Re: CVE request: phpldapadmin <= 1.2.1.1 XSS and and
 code injection flaws

On 10/24/2011 12:19 PM, Vincent Danen wrote:
> Two flaws were found in phpldapadmin <= 1.2.1.1 that can lead to an XSS
> or code injection:
>
> 1) Input appended to the URL in cmd.php (when "cmd" is set to "_debug")
> is not properly sanitised before being returned to the user. This can be
> exploited to execute arbitrary HTML and script code in a user's browser
> session in context of an affected site.

Please use CVE-2011-4074 for this one
>
> 2) Input passed to the "orderby" parameter in cmd.php (when "cmd" is set
> to "query_engine", "query" is set to "none", and "search" is set to e.g.
> "1") is not properly sanitised in lib/functions.php before being used in
> a "create_function()" function call. This can be exploited to inject and
> execute arbitrary PHP code.
Please use CVE-2011-4075 for this one

>
> Could CVEs be assigned to these please?
>
> References:
>
> http://sourceforge.net/tracker/index.php?func=detail&aid=3417184&group_id=61828&atid=498546
>
> http://www.exploit-db.com/exploits/18021/
> https://secunia.com/advisories/46551/
> http://phpldapadmin.git.sourceforge.net/git/gitweb.cgi?p=phpldapadmin/phpldapadmin;a=blobdiff;f=htdocs/cmd.php;h=0ddf0044355abc94160be73122eb34f3e48ab2d9;hp=34f3848fe4a6d4c00c7c568afa81f59579f5d724;hb=64668e882b8866fae0fa1b25375d1a2f3b4672e2;hpb=caeba72171ade4f588fef1818aa4f6243a68b85e
>
> http://phpldapadmin.git.sourceforge.net/git/gitweb.cgi?p=phpldapadmin/phpldapadmin;a=blobdiff;f=lib/functions.php;h=eb160dc9f7d74e563131e21d4c85d7849a0c6638;hp=19fde9974d4e5eb3bfac04bb223ccbefdb98f9a0;hb=76e6dad13ef77c5448b8dfed1a61e4acc7241165;hpb=5d4245f93ae6f065e7535f268e3cd87a23b07744
>
>

-- 

-Kurt Seifried / Red Hat Security Response Team

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.