Home page logo

oss-sec logo oss-sec mailing list archives

VICIDIAL 2.7 - SQL Injection, Command Injection
From: Adam Caudill <adam () adamcaudill com>
Date: Wed, 23 Oct 2013 02:52:06 -0400

Requestor: Adam Caudill, adam () adamcaudill com
Software: VICIDIAL (http://www.vicidial.org/vicidial.php)
Vendor: The Vicidial Group (http://www.vicidial.com/)
Vulnerability Type: Authenticated SQL Injection, Authenticated Command Injection

Source Code: http://sourceforge.net/projects/astguiclient/files/astguiclient_2.7rc1.zip/download
 Flaws exist in /www/agc/manager_send.php
 SQL Injection: Line 285
 Command Injection: Line 429

Affected Versions: 2.7RC1, 2.7, 2.8-403a (others likely)

Current released version is vulnerable; vendor confirmed issue on 6/3, set timeline for mid-July release, has delayed 
continually. Vendor has deployed fixes to users of their hosted service, still no updates or advisory for OSS users.

Affected lines of code:

  $stmt="SELECT count(*) from web_client_sessions where session_name='$session_name' and server_ip='$server_ip';";

  passthru("/usr/local/bin/sipsak -M -O desktop -B \"$SIPSAK_prefix$campaign\" -r 5060 -s sip:$extension () $phone_ip > 

In both of these cases, parameters are passed through without validation or escaping.

During setup, two accounts with hard-coded passwords are created (VDAD, VDCL), these can be used to bypass the 
authentication check, allowing access to where the SQL Injection vulnerability is, which can be used to bypass an 
additional check, thus giving access to the Command Injection vulnerability. The output from shell commands are 
returned in the server response.

There are MANY other issues of various types in this software, but I am not documenting them.

Adam Caudill
adam () adamcaudill com

Attachment: signature.asc
Description: Message signed with OpenPGP using GPGMail

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]