web-erp 0.1.4 database access vulnerability

2007.10.20
Credit: Ryan Fox
Risk: High
Local: Yes
Remote: Yes
CWE: N/A


CVSS Base Score: 7.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

================================== Security REPORT web-erp 0.1.4 and earlier ================================== Product: web-erp 0.1.4 and earlier Vulnerabilities: full database access Vendor: Phil Daintree (http://web-erp.sourceforge.net/) Vendor-Status: E-Mail to "p.daintree (at) xtra.co (dot) nz [email concealed]" date: 27.02.2003 Vendor-Patch: Vendor reports problem fixed in new version 0.1.5 (27.02.2003) Local: YES Remote: YES ============ Introduction ============ From web site: "WEB-ERP aims to provide a company with all the tools it needs to manage multi-currency debtors, multi-location stocks, multi-currency creditors as well as it's general accounting needs." ===================== Vulnerability Details ===================== 1) FULL DATABASE ACCESS http-requests to: ---*--- http://server/logicworks.ini ---*--- display the contents of this configuration file, unless the web server is specifically configured to handle .ini files differently. The contents include the MySQL username and password used by the application. With this username/password, a malicious person could connect to MySQL direct and add, modify, and delete data. severity: HIGH ======= Remarks ======= The author was very responsive and released a new, corrected version the same day. This vulnerability report was made using a recent post by Martin Eiszner as a template. Any similarity is no coincidence. ==================== Recommended Hotfixes ==================== Upgrade to 0.1.5, which the author reports fixes this problem. ======= Contact ======= Ryan Fox rfox (at) amerisuk (dot) com [email concealed]


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top