[NT] BetaParticle Database Disclosure and Arbitrary File Inclusion

From: SecuriTeam (support_at_securiteam.com)
Date: 05/26/05

  • Next message: SecuriTeam: "[NEWS] Multiple DNS Implementation DoS" 
    To: list@securiteam.com
Date: 26 May 2005 18:10:10 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      BetaParticle Database Disclosure and Arbitrary File Inclusion
    ------------------------------------------------------------------------

    SUMMARY

     <http://www.betaparticle.com/blog/index.html> BetaParticle is "a simple
    to use ASP CMS ( Blog + Gallery )".

    Two vulnerabilities discovered in BetaParticle CMS. Exploiting these two
    vulnerabilities allows an attacker to reveal administrator's login
    information and to access system's files with the possibility to delete or
    upload new files.

    DETAILS

    Vulnerable Systems:
     * BetaParticle versions 3.0 and prior

    Immune Systems:
     * BetaParticle version 4.0

    Database Disclosure:
    There is free access to database files, making its possible to download it
    and disclose the administrator username and password.

    Database path for versions prior to 3.0:
    http://example.com/bp/database/dbBlogMX.mdb
    Database path for version 3.0 and up: http://example.com/Blog.mdb

    Workaround:
    Move your DB to outside the web root and correct DB physical path.

    Upload/Delete Arbitrary Files:
    By accessing the following user interface, a remote attacker can initiate
    a upload mechanism without having to be logged on as administrator:
    http://example.com/bp/upload.asp

    By accessing the following user interface, a remote attacker can initiate
    the deletion of files without having to be logged on as administrator:
    http://example.com/bp/myFiles.asp

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:farhadkey@yahoo.com> farhad
    koosha.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[NEWS] Multiple DNS Implementation DoS"

    Relevant Pages

    • [NT] Cross Application Scripting in Trend Micros Antivirus Software
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... The SecuriTeam alerts list - Free, Accurate, Independent. ... When the product alerts the user of a possible virus, it creates an HTML ...
      (Securiteam)
    • [NT] Microsoft Windows NTFS Improper Handler Closing
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... from a system shutdown, uninitialized data may be visible in files from ...
      (Securiteam)
    • [TOOL] tcpstatflow - Covert Tunnel Detector
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... For example, he could set up a SSH server on the Internet, listening port ... one way and the opposite (within a single TCP connection). ...
      (Securiteam)
    • [EXPL] Eudora Attachment Spoof Exploit Revisited
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... present in the newest release of Eudora. ... Can be exploited if there is more than one way into attach: in my setup ...
      (Securiteam)
    • [UNIX] Phorum SQL Injection (userlogin.php)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... An SQL injection vulnerability exists in the 'userlogin.php' script. ... the MD5 hash of the user one character at a time. ...
      (Securiteam)