From: Secunia Security Advisories (sec-advsecunia.com)
Date: Wed Dec 06 2006 - 08:17:05 CST

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

----------------------------------------------------------------------

Secunia is proud to announce the availability of the Secunia Software
Inspector.

The Secunia Software Inspector is a free service that detects insecure
versions of software that you may have installed in your system. When
insecure versions are detected, the Secunia Software Inspector also
provides thorough guidelines for updating the software to the latest
secure version from the vendor.

Try it out online:
http://secunia.com/software_inspector/

----------------------------------------------------------------------

TITLE:
deV!L'z Clanportal File Upload and SQL Injection

SECUNIA ADVISORY ID:
SA23194

VERIFY ADVISORY:
http://secunia.com/advisories/23194/

CRITICAL:
Highly critical

IMPACT:
Manipulation of data, System access

WHERE:
From remote

SOFTWARE:
deV!L'z Clanportal 1.x
http://secunia.com/product/12831/

DESCRIPTION:
Tim Weber has discovered two vulnerabilities in deV!L'z Clanportal,
which can be exploited by malicious people to compromise a vulnerable
system and manipulate data.

1) The upload/index.php script fails to validate the extension of an
uploaded file. This can be exploited to upload files with the ".php"
extension and execute arbitrary PHP code on the server.

Successful exploitation requires passing an allowed MIME media type
in the HTTP headers and creating a file that is both a syntactically
correct PHP script and a JPEG or GIF image that the PHP function
getimagesize() will consider correct.

2) Input passed to the "show" parameter in sites/index.php is not
properly sanitised before being used in SQL queries. This can be
exploited to manipulate SQL queries by injecting arbitrary SQL code.

Successful exploitation reportedly allows granting a user
administrator privileges, but requires that "magic_quotes_gpc" is
disabled.

The vulnerabilities are confirmed in version 1.3.6. Other versions
may also be affected.

SOLUTION:
Update to version 1.3.6.1.

PROVIDED AND/OR DISCOVERED BY:
Tim Weber

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/

Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories

----------------------------------------------------------------------

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]