Twenty Year Anniversary

ADOdb-4.71.txt

ADOdb-4.71.txt
Posted Feb 22, 2006
Authored by James Bercegay | Site gulftech.org

There are several cross site scripting issues within the ADODB_Pager class that may allow for an attacker to render malicious client side code in the victims browser.

tags | advisory, xss
MD5 | 55b5660568375f3ae73cd0d28274d1a8

ADOdb-4.71.txt

Change Mirror Download
##########################################################
# GulfTech Security Research February 18, 2006
##########################################################
# Vendor : John Lim
# URL : http://adodb.sourceforge.net/
# Version : ADOdb <= 4.71
# Risk : Cross Site Scripting
##########################################################



Description:
ADOdb is a database abstraction library for php used by a
great deal of projects to provide support for a number of
well known database api's. ADOdb also comes with various
functions to perform routine database related tasks. One
of the more useful of these functions is ADOdb's ability
to paginate the retrieved database records by using the
ADODB_Pager class. However, there are several cross site
scripting issues within the ADODB_Pager class that may
allow for an attacker to render malicious client side code
in the victims browser. An updated version of ADOdb has been
released, and users should update their ADOdb library.



Cross Site Scripting:
There are several Cross Site Scripting issues in ADOdb versions
4.71 and possibly earlier that may allow for an attacker to
render malicious client side code in the victim's browser.

if (isset($_GET[$next_page])) {
$_SESSION[$curr_page] = $_GET[$next_page];
}
if (empty($_SESSION[$curr_page])) $_SESSION[$curr_page] = 1; ## at first
page

$this->curr_page = $_SESSION[$curr_page];

The above code is taken from adodb-pager.inc.php @ lines 72-77
and ultimately set's the $this->curr_page variable to unsanitized
user supplied input. Later on this variable is used when drawing
the links for the pagination, thus allowing for Cross Site
Scripting attacks to be possible. There are also several unsafe
PHP_SELF calls within the script that allow for similar Cross
Site Scripting attacks. In addition to these issues there are
also several input validation issues in the performance scripts
such as adodb-perf.inc.php and perf-oci8.inc.php, but these
will not be addressed as the author says:

"The adodb perf files assume that you can execute any
sql in the system from the sql form we provide. True
that there could be security issues in the perf
scripts, but using the perf files already assume (and
require) a high level of trust."

We may include details of these vulnerabilities in this
advisory at a later date. However, a new version of ADOdb
was just released to address the previously mentioned Cross
Site Scripting issues.



Solution:
A new version of ADOdb was recently released which addresses
the previously mentioned Cross Site Scripting issues. Users
should upgrade their current vulnerable ADOdb libraries. Thanks
to John Lim for a very prompt resolution to this issue.



Related Info:
The original advisory can be found at the following location
http://www.gulftech.org/?node=research&article_id=00101-02182006

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

Want To Donate?


Bitcoin: 18PFeCVLwpmaBuQqd5xAYZ8bZdvbyEWMmU

File Archive:

June 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    14 Files
  • 2
    Jun 2nd
    1 Files
  • 3
    Jun 3rd
    3 Files
  • 4
    Jun 4th
    18 Files
  • 5
    Jun 5th
    21 Files
  • 6
    Jun 6th
    8 Files
  • 7
    Jun 7th
    16 Files
  • 8
    Jun 8th
    18 Files
  • 9
    Jun 9th
    5 Files
  • 10
    Jun 10th
    2 Files
  • 11
    Jun 11th
    21 Files
  • 12
    Jun 12th
    32 Files
  • 13
    Jun 13th
    15 Files
  • 14
    Jun 14th
    16 Files
  • 15
    Jun 15th
    4 Files
  • 16
    Jun 16th
    1 Files
  • 17
    Jun 17th
    2 Files
  • 18
    Jun 18th
    15 Files
  • 19
    Jun 19th
    15 Files
  • 20
    Jun 20th
    15 Files
  • 21
    Jun 21st
    15 Files
  • 22
    Jun 22nd
    7 Files
  • 23
    Jun 23rd
    0 Files
  • 24
    Jun 24th
    0 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close