exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

sqllitemanager120-multi.txt

sqllitemanager120-multi.txt
Posted Feb 28, 2007
Authored by Simon Bonnard

SQLiteManager version 1.2.0 suffers from local file inclusion and multiple cross site scripting vulnerabilities.

tags | exploit, local, vulnerability, xss, file inclusion
SHA-256 | 0801568530feffe7fc7f87e429113facaddaa00f9cb11a79d66f5f6bea21c0cd

sqllitemanager120-multi.txt

Change Mirror Download
SQLiteManager v1.2.0 Multiple Vulnerabilities
-------------------------------------------------------
vendor : http://www.sqlitemanager.org/
Global risk : High
-------------------------------------------------------

SQLite is a SQL managed portal like PhpMyAdmin.

Multiple Cross Scripting Vulnerabilities
-----------------------------------------

In main.php the database name field is vulnerable to a XSS attack.
This xss is permanent, if a user with restricted rights creates a
table with as name a malicious code the administrator gone get his
cookie stealed when he opens SqliteManager's index. The same things
happens for the table's name field if a malicious code is inserted.

The solution is then to use htmlentities().

others vulnerables fields to XSS attacks :

main.php :
............... ViewName
............... view
............... trigger
............... function
............... (...)

Theses vulnerabilities are presents in others pages too.
Here too the better solution is to use htmlentities().

reference : www.php.net/htmlentities

Locale File Include
-------------------

GET /home/sqlite/ HTTP/1.0
[...]
Cookie: PHPSESSID=[...];SQLiteManager_currentTheme=../../../../../../../../../../../../../etc/passwd%00;
SQLiteManager_currentLangue=deleted

SQLiteManager_currentTheme variable is vulnerable.
This request will returns the /etc/passwd file.

This vulnerability is dangerous, indeed a user with restricted access to SqliteManage
could get non-authorized files.

Regards,

Simon Bonnard - 24/02/2007
Contact : simon.itsecurity[at]gmail[dot]com
Login or Register to add favorites

File Archive:

September 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    261 Files
  • 2
    Sep 2nd
    17 Files
  • 3
    Sep 3rd
    38 Files
  • 4
    Sep 4th
    52 Files
  • 5
    Sep 5th
    23 Files
  • 6
    Sep 6th
    27 Files
  • 7
    Sep 7th
    0 Files
  • 8
    Sep 8th
    1 Files
  • 9
    Sep 9th
    16 Files
  • 10
    Sep 10th
    38 Files
  • 11
    Sep 11th
    21 Files
  • 12
    Sep 12th
    40 Files
  • 13
    Sep 13th
    18 Files
  • 14
    Sep 14th
    0 Files
  • 15
    Sep 15th
    0 Files
  • 16
    Sep 16th
    21 Files
  • 17
    Sep 17th
    51 Files
  • 18
    Sep 18th
    23 Files
  • 19
    Sep 19th
    0 Files
  • 20
    Sep 20th
    0 Files
  • 21
    Sep 21st
    0 Files
  • 22
    Sep 22nd
    0 Files
  • 23
    Sep 23rd
    0 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    0 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2024 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close