[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAAsmaPbQvEhYDc8bznLoi2TBbfKk_7uNSGHtHZLpbzUCX5RCsw@mail.gmail.com>
Date: Tue, 15 Mar 2016 15:27:05 -0500
From: Tim Zingelman <tez@...src.org>
To: oss-security@...ts.openwall.com
Subject: Re: please assign CVE for cacti bug 2667: SQL
Injection Vulnerability
This seems to fix it...
diff -u tree.php.orig tree.php
--- tree.php.orig 2016-03-15 15:15:37.646641203 -0500
+++ tree.php 2016-03-15 15:19:45.966120414 -0500
@@ -153,6 +153,7 @@
/* ================= input validation ================= */
input_validate_input_number(get_request_var("id"));
input_validate_input_number(get_request_var("tree_id"));
+ input_validate_input_number(get_request_var("parent_id"));
/* ==================================================== */
if (!empty($_GET["id"])) {
On Thu, Mar 10, 2016 at 10:06 AM, Paul Gevers <elbrus@...ian.org> wrote:
> Hi
>
> I just found the description below about an sql vulnerability in the
> cacti bug tracker: http://bugs.cacti.net/view.php?id=2667
>
> Can a CVE be assigned for this issue?
> Thanks
>
> ==========================
> Advisory: Cacti SQL Injection Vulnerability
> Author: Do9gy of Tencent Security Platform Department
> Affected Version: 0.8.8.g(the latest version & the older versions)
> ==========================
> Vulnerability Description
> ==========================
>
> Recetly, I found a SQL Injection Vulnerability in ‘Cacti-0.8.8g'
> program, Cacti is widely used in many companies.
> Vulnerable file: /cacti/tree.php:
> line 208:
> ==========================================================================================================================================
> switch ($current_type) {
> case TREE_ITEM_TYPE_HEADER:
> $i = 0;
> /* it's nice to default to the parent sorting style for new items */
> if (empty($_GET["id"])) {
> $default_sorting_type = db_fetch_cell("select
> sort_children_type from graph_tree_items where id=" . $_GET["parent_id"]);
> }else{
> $default_sorting_type = TREE_ORDERING_NONE;
> }
>
> ==========================================================================================================================================
>
> The parameter parent_id is used without any validation.
> ==========================
> POC && EXP
> ==========================
> 1. Login
>
> 2.
> http://target/cacti-0.8.8g/tree.php?action=item_edit&tree_id=2&parent_id=8%20and%20sleep(1)
> [^]
>
> 3. mysql log: select sort_children_type from graph_tree_items where id=8
> and sleep(1)
>
>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
