====================================================================== Secunia Research 13/07/2006 - CMS Mundo SQL Injection Vulnerabilities - ====================================================================== Table of Contents Affected Software....................................................1 Severity.............................................................2 Description of Vulnerabilities.......................................3 Solution.............................................................4 Time Table...........................................................5 Credits..............................................................6 References...........................................................7 About Secunia........................................................8 Verification.........................................................9 ====================================================================== 1) Affected Software CMS Mundo 1.0 build 008 Other versions may also be affected. Product Link: http://www.hotwebscripts.com/index.php?mod=webshop&function= showDetails&id=76 ====================================================================== 2) Severity Rating: Moderately critical Impact: Manipulation of data Where: From remote ====================================================================== 3) Description of Vulnerabilities Secunia Research has discovered some vulnerabilities in CMS Mundo, which can be exploited by malicious people to conduct SQL injection attacks. Some input isn't properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. Examples: http://[host]/?mod=news&function=showNews&news_id=[code] http://[host]/?mod=search&function=doSearch&searchstring=[code] http://[host]/?mod=webshop&function=showDetails&id=[code] * The "username" parameter passed in index.php during customer login * The "Name", "Address", "Zip", "City", "Country", and "Email" fields when updating the user profile Successful exploitation requires that "magic_quotes_gpc" is disabled. ====================================================================== 4) Solution Edit the source code to ensure that input is properly sanitised. ====================================================================== 5) Time Table 30/05/2006 - Initial vendor notification. 28/06/2006 - Additional vulnerabilities reported to the vendor. 12/07/2006 - Final reminder. 13/07/2006 - Public disclosure. ====================================================================== 6) Credits Discovered by Andreas Sandblad, Secunia Research. ====================================================================== 7) References The Common Vulnerabilities and Exposures (CVE) project has assigned CVE-2006-3135 for the vulnerabilities. ====================================================================== 8) About Secunia Secunia collects, validates, assesses, and writes advisories regarding all the latest software vulnerabilities disclosed to the public. These advisories are gathered in a publicly available database at the Secunia website: http://secunia.com/ Secunia offers services to our customers enabling them to receive all relevant vulnerability information to their specific system configuration. Secunia offers a FREE mailing list called Secunia Security Advisories: http://secunia.com/secunia_security_advisories/ ====================================================================== 9) Verification Please verify this advisory by visiting the Secunia website: http://secunia.com/secunia_research/2006-52/advisory/ Complete list of vulnerability reports published by Secunia Research: http://secunia.com/secunia_research/ ======================================================================