On Mon, Apr 21, 2008 at 5:06 PM, Mark Crowther <mark.crowther () irmplc com>
RedDot CMS SQL injection vulnerability (CVE Number: CVE-2008-1613)
Vulnerability Type/Importance: SQL injection/Critical
Problem Discovered: 12 February 2008
Vendor Contacted: 19 February 2008
Advisory Published: 21 April 2008
The RedDot CMS Product (http://www.reddot.com) is vulnerable to a
pre-authentication SQL injection vulnerability which, when exploited,
enumeration of all SQL database content.
The 'LngId' Parameter passed to IoRD.asp is responsible for assigning the
language context for the CMS application. The vulnerability exists as a
result of inadequate validation of user-supplied input within this
Normal input for the 'LngId' parameter contains a code such as ENG, DEU,
denoting the language type. This parameter is not properly validated and
injection of SQL statements within it allows attackers unrestricted access
to enumerate information from the database. For example:
FROM IO_DGC_ENG UNION SELECT min(name) FROM SYSOBJECTS where
and name> '' ORDER BY 1;-- &DisableAutoLogin=1
Proof of Concept:
A Proof of Concept (RDdbenum.py) has been developed to automate
of entire database content available from
Workaround / Solutions:
There are no known workarounds for this vulnerability
The Vendor has released a patch for this vulnerability, Release 18.104.22.168,
available from normal Red Dot customer support contacts.
Tested / Affected Versions:
IRM confirmed the presence of this vulnerability in RedDot CMS version 7.5
Build 22.214.171.124, tested with Microsoft SQL Server 2005 database.
It is believed that this issue exists in RedDot CMS versions 6.5 and 7.0;
however this has not been fully verified.
Research and Advisory: Mark Crowther and Rodrigo Marcos
Can we keep these for Web Application Security Awareness Day? It'll
have a bigger impact on Web Application Security than releasing them
in dribs and drabs.
If you care about about Web Application Security, you'll be doing more
good waiting off till the end of the month.
We need to talk in one voice on May 1st... you'll be heard louder and
probably people will take more notice of your vulnerability than
I'm going to be compiling a big list of every vulnerability released
on May 1st, its going to be awesome.
The security industry will have no choice but to listen to the
security community!!! Its full of epic win.