Vulners
Lucene search
PHP Grade Book 1.9.4 - SQL Database Export
| Reporter | Title | Published | Views | Family All 11 |
|---|---|---|---|---|
 | PHP Grade Book 1.9.4 Unauthenticated SQL Database Export | 22 Mar 201200:00 | – | zdt |
 | CVE-2012-1670 | 22 Mar 201200:00 | – | circl |
 | CVE-2012-1670 | 31 Mar 201214:00 | – | cve |
 | CVE-2012-1670 | 31 Mar 201214:00 | – | cvelist |
 | PHP Grade Book 1.9.4 - SQL Database Export | 22 Mar 201200:00 | – | exploitpack |
 | CVE-2012-1670 | 31 Mar 201214:55 | – | nvd |
 | PHP Grade Book 1.9.4 SQL Database Export | 23 Mar 201200:00 | – | packetstorm |
 | Design/Logic Flaw | 31 Mar 201214:55 | – | prion |
 | 'PHP Grade Book' Unauthenticated SQL Database Export (CVE-2012-1670) | 9 Apr 201200:00 | – | securityvulns |
| Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl) | 9 Apr 201200:00 | – | securityvulns |
10
'PHP Grade Book' Unauthenticated SQL Database Export (CVE-2012-1670)
Mark Stanislav - [email protected]
I. DESCRIPTION
---------------------------------------
A vulnerability exists in admin/index.php that allows for an unauthenticated user to export the entire application database by accessing the 'Database Backup' method without restriction. Due to the way sessions are handled, an attacker can then simply pass the username and password-hash via cookies to assume the administrative role without ever knowing the clear-text version of the password.
II. TESTED VERSION
---------------------------------------
1.9.4
III. PoC EXPLOIT
---------------------------------------
http://localhost/phpGradeBook/admin/index.php?action=SaveSQL
IV. SOLUTION
---------------------------------------
Upgrade to 1.9.5 or above.
V. REFERENCES
---------------------------------------
http://sourceforge.net/projects/php-gradebook/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1670
VI. TIMELINE
---------------------------------------
02/29/2012 - Initial vendor disclosure
02/29/2012 - Vendor response and commitment to fix
03/01/2012 - Vendor patched and released an updated version
03/22/2012 - Public disclosureData
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
22 Mar 2012 00:00Current
6.5Medium risk
Vulners AI Score6.5
CVSS 25
EPSS0.07493