[Full-disclosure] Secunia Research: ADOdb Insecure Test Scripts Security Issues

======================================================================

                 Secunia Research 09/01/2006

        - ADOdb Insecure Test Scripts Security Issues -

======================================================================
Table of Contents

Affected Software…1
Severity…2
Vendor's Description of Software…3
Description of Security Issues…4
Solution…5
Time Table…6
Credits…7
About Secunia…8
Verification…9

======================================================================
1) Affected Software

ADOdb versions 4.66 and 4.68 for PHP

The following applications have been confirmed to insecurely bundle
test scripts for the ADOdb library:

• Mantis versions 0.19.4 and 1.0.0rc4
• PostNuke version 0.761 (only security issue #1)
• Moodle version 1.5.3
• Cacti version 0.8.6g (only security issue #1)

Other versions may also be affected.

======================================================================
2) Severity

Rating: Less critical
Impact: System access
Exposure of system information
Security bypass
Where: Remote

======================================================================
3) Vendor's Description of Software

ADOdb is a database abstraction library for PHP.

Product link:
http://adodb.sourceforge.net/

======================================================================
4) Description of Security Issues

Secunia Research has discovered two security issues in ADOdb, which
can be exploited by malicious people to disclose system information,
execute arbitrary SQL code, and potentially compromise a vulnerable
system.

1) The problem is caused due to the presence of the insecure
"server.php" test script. This can be exploited to execute arbitrary
SQL code with full MySQL database privileges via the "sql" parameter.

Example:
http://[victim]/server.php?sql=SELECT '[content]' INTO OUTFILE '[file]'

This can further be exploited to create an arbitrary PHP script in a
directory inside the web root writable by the MySQL user.

Successful exploitation requires that the MySQL password for the root
user is empty and that the affected script is placed accessible
inside the web root.

2) The problem is caused due to the presence of the insecure
"tests/tmssql.php" test script. This can be exploited to call an
arbitrary PHP function via the "do" parameter.

Example:
http://[victim]/tests/tmssql.php?do=phpinfo

Successful exploitation requires that the affected script is placed
accessible inside the web root.

The security issues have been confirmed in versions 4.66 and 4.68 for
PHP. Other versions may also be affected.

======================================================================
5) Solution

ADOdb:
Update to version 4.70 for PHP.
http://sourceforge.net/project/showfiles.php?group_id=42718

Mantis:
Restrict web access to PHP scripts in the "core/adodb" directory
(e.g. with a .htaccess file).

PostNuke:
Update to version 0.761a.
http://downloads.postnuke.com/

Moodle:
The security issues have been fixed in the latest stable branch
(Moodle 1.5.3 +).

Cacti:
Update to version 0.8.6h.
http://www.cacti.net/download_cacti.php

======================================================================
6) Time Table

30/12/2005 - Initial vendor notification.
03/01/2006 - Other affected vendors notified.
05/01/2006 - Initial vendor reply.
08/01/2006 - New version of ADOdb released.
09/01/2006 - Public disclosure.

======================================================================
7) Credits

Discovered by Andreas Sandblad, Secunia Research.

======================================================================
8) About Secunia

Secunia collects, validates, assesses, and writes advisories regarding
all the latest software vulnerabilities disclosed to the public. These
advisories are gathered in a publicly available database at the
Secunia website:

http://secunia.com/

Secunia offers services to our customers enabling them to receive all
relevant vulnerability information to their specific system
configuration.

Secunia offers a FREE mailing list called Secunia Security Advisories:

http://secunia.com/secunia_security_advisories/

======================================================================
9) Verification

Please verify this advisory by visiting the Secunia website:
http://secunia.com/secunia_research/2005-64/advisory/

Complete list of vulnerability reports published by Secunia Research:
http://secunia.com/secunia_research/

======================================================================

---

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/