web-erp 0.1.4 database access vulnerability

From: Ryan Fox (rfox@amerisuk.com)
Date: 03/01/03

  • Next message: Michael Schwartzkopff: "Security responsible at AOL" 
    From: "Ryan Fox" <rfox@amerisuk.com>
To: <bugtraq@securityfocus.com>
Date: Fri, 28 Feb 2003 22:14:49 -0500

    ==================================
    Security REPORT web-erp 0.1.4 and earlier
    ==================================
    Product: web-erp 0.1.4 and earlier
    Vulnerabilities: full database access
    Vendor: Phil Daintree (http://web-erp.sourceforge.net/)
    Vendor-Status: E-Mail to "p.daintree@xtra.co.nz" date: 27.02.2003
    Vendor-Patch: Vendor reports problem fixed in new version 0.1.5 (27.02.2003)

    Local: YES
    Remote: YES

    ============
    Introduction
    ============
    From web site:
    "WEB-ERP aims to provide a company with all the tools it needs to manage
    multi-currency debtors, multi-location stocks, multi-currency creditors as
    well as it's general accounting needs."

    =====================
    Vulnerability Details
    =====================
    1) FULL DATABASE ACCESS

    http-requests to:

    ---*---
    http://server/logicworks.ini
    ---*---

    display the contents of this configuration file, unless the web server is
    specifically configured to handle .ini files differently. The contents
    include the MySQL username and password used by the application. With this
    username/password, a malicious person could connect to MySQL direct and add,
    modify, and delete data.

    severity: HIGH

    =======
    Remarks
    =======
    The author was very responsive and released a new, corrected version the
    same day.

    This vulnerability report was made using a recent post by Martin Eiszner as
    a template. Any similarity is no coincidence.

    ====================
    Recommended Hotfixes
    ====================
    Upgrade to 0.1.5, which the author reports fixes this problem.

    =======
    Contact
    =======

    Ryan Fox
    rfox@amerisuk.com

    Relevant Pages