mailing list archives
XeoPort <= 0.81 SQL Injection Vulnerability
From: Tamriel <tamriel () gmx net>
Date: Wed, 11 Oct 2006 22:19:57 -0500
-----BEGIN PGP SIGNED MESSAGE-----
Advisory: XeoPort <= 0.81 SQL Injection Vulnerability
Release Date: 10/12/2006
Last Modified: 10/12/2006
Author: Tamriel [tamriel at gmx dot net]
Application: XeoPort <= 0.81
Vendor Status: not contacted
Vendor Site: www.xeoman.com | www.xeoman.de
Quote from www.xeoman.de:
"XeoPort imports emails from an IMAP or POP3 server into
your MySQL database. The text part and/ or the entire message
will be imported. An elegant way for Outlook Express users
(like me) to extract messages from Microsofts proprietary
binary format. I tried Access via Outlook but it turned out
to be buggy all the way. The additional script show.php
(folder goodie) uses Outlook Express to display the entire
message if you want to get your hands on attached files. It
can be used to dump the entire MySQL database back into Outlook
Express messages providing kind of a backup."
There are is a SQL injection vulnerability which can be
exploited by malicious people to conduct SQL injection attacks.
The vulnerability has been discovered in the latest version,
0.81. Other versions may also be affected.
SQL Injection in index.php
The Input `$xp_body_text` parameter isn't properly sanitised
before being used in a SQL query.
An attacker must send an Email with 7bit encoding to perform
Some other variables may also be affected.
Proof of Concept:
You must have register_globals enabled to run this script,
disable it and edit the source code to ensure that input is
properly sanitised and change all input variables.
Use functions like PHP's htmlentities() and
10/12/2006 - Discovery of the vulnerabilities
10/12/2006 - Public disclosure
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (MingW32)
-----END PGP SIGNATURE-----
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/
- XeoPort <= 0.81 SQL Injection Vulnerability Tamriel (Oct 12)