mailing list archives
IRM Security Advisory : RedDot CMS SQL injection vulnerability
From: "Mark Crowther" <mark.crowther () irmplc com>
Date: Mon, 21 Apr 2008 17:10:10 +0100
RedDot CMS SQL injection vulnerability (CVE Number: CVE-2008-1613)
Vulnerability Type/Importance: SQL injection/Critical
Problem Discovered: 12 February 2008
Vendor Contacted: 19 February 2008
Advisory Published: 21 April 2008
The RedDot CMS Product (http://www.reddot.com) is vulnerable to a pre-authentication SQL injection vulnerability which,
when exploited, allows enumeration of all SQL database content.
The 'LngId' Parameter passed to IoRD.asp is responsible for assigning the language context for the CMS application. The
vulnerability exists as a result of inadequate validation of user-supplied input within this parameter.
Normal input for the 'LngId' parameter contains a code such as ENG, DEU, JP, denoting the language type. This parameter
is not properly validated and the injection of SQL statements within it allows attackers unrestricted access to
enumerate information from the database. For example:
https://vulnerablehost.com:443/cms/ioRD.asp?Action=ShowMessage&LngId=ENG.DGC0 FROM IO_DGC_ENG UNION SELECT min(name)
FROM SYSOBJECTS where xtype=char(85) and name> '' ORDER BY 1;-- &DisableAutoLogin=1
Proof of Concept:
A Proof of Concept (RDdbenum.py) has been developed to automate enumeration of entire database content available from
Workaround / Solutions:
There are no known workarounds for this vulnerability
The Vendor has released a patch for this vulnerability, Release 18.104.22.168, available from normal Red Dot customer
Tested / Affected Versions:
IRM confirmed the presence of this vulnerability in RedDot CMS version 7.5 Build 22.214.171.124, tested with Microsoft SQL
Server 2005 database.
It is believed that this issue exists in RedDot CMS versions 6.5 and 7.0; however this has not been fully verified.
Research and Advisory: Mark Crowther and Rodrigo Marcos
All information in this advisory is provided on an 'as is' basis in the hope that it will be useful. Information Risk
Management Plc is not responsible for any risks or occurrences caused by the application of this information.
- IRM Security Advisory : RedDot CMS SQL injection vulnerability Mark Crowther (Apr 21)