mailing list archives
Re: Re: CVE request: multiple vulnerabilities in dtc
From: Josh Bressers <bressers () redhat com>
Date: Wed, 24 Aug 2011 16:34:30 -0400 (EDT)
----- Original Message -----
Insufficient input checking in /shared/inc/sql/lists.php
The setup script for dtc writes the password for the MySQL user in the
world-readable file /etc/apache2/apache2.conf.
Insufficient input checking leads to a SQL injection vulnerability in
A SQL injection vulnerability in logPushlet.php can overwrite arbitrary
files as the MySQL system user.
I'm grouping the above two together.
dtc passes passwords to htpasswd using command line arguments, which
can be read by a local user.
dtc does not escape variables in HTML output in many places; for
example in the "Domain root TXT record:" field on the "DNS and MX" page
Let's call this "multiple XSS flaws"
Thanks for sorting the original list.