what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

LedgerSMB 1.2.24 SQL Injection

LedgerSMB 1.2.24 SQL Injection
Posted Aug 25, 2011
Authored by Chris Travers

The LedgerSMB development team has found an SQL injection issue in LedgerSMB version 1.2.24. Because this issue stems from their common SQL-Ledger heritage, it affects all versions of LedgerSMB and has been confirmed in SQL-Ledger version 2.8.33.

tags | advisory, sql injection
SHA-256 | d46a40d761ab4f653c338833304f4974937256b45896dba52e8970d226b6ce1c

LedgerSMB 1.2.24 SQL Injection

Change Mirror Download
Hi all;

The LedgerSMB development team has found an SQL injection issue in
LedgerSMB 1.2.24. Because this issue stems from our common SQL-Ledger
heritage, it affects all versions of LedgerSMB and has been confirmed
in SQL-Ledger 2.8.33. We contacted Dieter when we initially
discovered this and now three weeks later it is doubtful when this
will be fixed on his side (his last communication said it was likely
to be at least a few more weeks from present with no committed
timeline). It is expected that when SQL-Ledger 2.8.34 is released it
will contain a fix for this issue.

Versions affected:
SQL Ledger, all 2.6 and 2.8 versions, possibly older versions as well.
LedgerSMB production versions 1.2.24 and earlier
LedgerSMB trunk, SVN revisions up through 3598

Effect:
Allows arbitrary SQL commands to be run

Login required: Yes

Overall impact: In LedgerSMB 1.2 and SQL-Ledger, in typical setups,
this allows virtually all data in the database to be tampered with by
a successful attacker. Audit trails can be overwritten, transactions
entered for fraudulent purposes, etc. This should be seen among these
users as a critical fix.

For those running LedgerSMB 1.3 snapshots, betas, etc, the
vulnerability could allow someone to enter invalid data into the
database. However the actual audit trails etc, are generally expected
not to be subject to this tampering and the access to the database is
much narrower. Remember that security is enforced by the database in
1.3.0 so this does not pose a privilege escalation issue as it would
in 1.2.x and below. For this reason this should be seen among these
users as a moderately important problem, which should be fixed as soon
as possible but isn't as critical as it is on past versions.

We have released a fix for this issue. It has not been fully
regression tested and therefore we recommend putting it through a
little testing before putting it into production. This is the only
fix found in 1.2.25-rc1 (vs 1.2.24). For those interested in
installing the normal way, please download from
https://sourceforge.net/projects/ledger-smb/files/Development%20Snapshots/1.2.25-rc1/

We expect 1.2.25 to hit general release by Monday assuming no problems
are found with this fix.

Those who are not able to upgrade are welcome to contact me for a
patch that contains the fix. Again it should be put through some
testing before being put into production,

Credit for discovery of the problem goes to Erik Huelsmann.

We expect to release a full disclosure email with exploit information
in a few weeks, after everyone has a chance to upgrade. The purpose
of that email will be to facilitate the development of automated
vulnerability tests by security vendors.

Thank you for your time,
Chris Travers
LedgerSMB Core Team
Login or Register to add favorites

File Archive:

December 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Dec 1st
    11 Files
  • 2
    Dec 2nd
    0 Files
  • 3
    Dec 3rd
    0 Files
  • 4
    Dec 4th
    0 Files
  • 5
    Dec 5th
    0 Files
  • 6
    Dec 6th
    0 Files
  • 7
    Dec 7th
    0 Files
  • 8
    Dec 8th
    0 Files
  • 9
    Dec 9th
    0 Files
  • 10
    Dec 10th
    0 Files
  • 11
    Dec 11th
    0 Files
  • 12
    Dec 12th
    0 Files
  • 13
    Dec 13th
    0 Files
  • 14
    Dec 14th
    0 Files
  • 15
    Dec 15th
    0 Files
  • 16
    Dec 16th
    0 Files
  • 17
    Dec 17th
    0 Files
  • 18
    Dec 18th
    0 Files
  • 19
    Dec 19th
    0 Files
  • 20
    Dec 20th
    0 Files
  • 21
    Dec 21st
    0 Files
  • 22
    Dec 22nd
    0 Files
  • 23
    Dec 23rd
    0 Files
  • 24
    Dec 24th
    0 Files
  • 25
    Dec 25th
    0 Files
  • 26
    Dec 26th
    0 Files
  • 27
    Dec 27th
    0 Files
  • 28
    Dec 28th
    0 Files
  • 29
    Dec 29th
    0 Files
  • 30
    Dec 30th
    0 Files
  • 31
    Dec 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close