[UNIX] SQL Injection in CitrusDB

From: SecuriTeam (support_at_securiteam.com)
Date: 02/22/05

  • Next message: SecuriTeam: "[NT] Multiple Integer Overflow Vulnerabilities In PuTTY SFTP" 
    To: list@securiteam.com
Date: 22 Feb 2005 15:58:10 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      SQL Injection in CitrusDB
    ------------------------------------------------------------------------

    SUMMARY

    " <http://www.citrusdb.org/> CitrusDB is an open source customer database
    application that uses PHP and a database backend (currently MySQL) to keep
    track of customer information, services, products, billing, and customer
    service information. The program will run on any PHP enabled web server."

    CitrusDB contains a vulnerability that allows a remote attacker to
    initiate an SQL injection vulnerability by uploading a malicious CSV file.

    DETAILS

    Vulnerable Systems:
     * CitrusDB version 0.3.6 and prior

    CVE Information:
     <http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0410>
    CAN-2005-0410

    CitrusDB does not filter special characters (e.g. single quotes) from
    uploaded CSV files. In the file ./citrusdb/tools/importcc.php the data
    from a previous uploaded CSV file is inserted into the MySQL database but
    none of the values are filtered.

    Proof of Concept:
    A CSV file containing single quotes ('), makes the SQL Query found in
    /citrusdb/tools/importcc.php to fail.

    Disclosure Timeline:
    2005-02-04 Vendor notified
    2005-02-12 CVE number requested
    2005-02-14 CVE number obtained (CAN-2005-0410)

    ADDITIONAL INFORMATION

    The information has been provided by
    <mailto:dornseif@informatik.rwth-aachen.de> Maximillian Dornseif.
    The original article can be found at:
    <http://tsyklon.informatik.rwth-aachen.de/redteam/advisories/rt-sa-2005-004> http://tsyklon.informatik.rwth-aachen.de/redteam/advisories/rt-sa-2005-004

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[NT] Multiple Integer Overflow Vulnerabilities In PuTTY SFTP"

    Relevant Pages

    • [UNIX] Credit Card Data Disclosure in CitrusDB
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... CitrusDB is "an open source customer database ... CitrusDB uses a textfile to temporarily store credit card information. ...
      (Securiteam)
    • [UNIX] CitrusDB Directory Traversal and Arbitrary File Upload
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... inaccessible, and uploading of arbitrary CSV files, that allows uploading ... a CSV file containing credit card data. ... to the temporary file that stores the uploaded credit card data and may ...
      (Securiteam)
    • [NT] Cross Application Scripting in Trend Micros Antivirus Software
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... The SecuriTeam alerts list - Free, Accurate, Independent. ... When the product alerts the user of a possible virus, it creates an HTML ...
      (Securiteam)
    • [NT] Microsoft Windows NTFS Improper Handler Closing
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... from a system shutdown, uninitialized data may be visible in files from ...
      (Securiteam)
    • [EXPL] Eudora Attachment Spoof Exploit Revisited
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... present in the newest release of Eudora. ... Can be exploited if there is more than one way into attach: in my setup ...
      (Securiteam)