China-on-site FlexPHPSite 0.0.1/0.0.7 checkpass sql injection

Summaryinfo

A vulnerability described as critical has been identified in China-on-site FlexPHPSite 0.0.1/0.0.7. Affected is an unknown function. The manipulation of the argument checkpass results in sql injection. This vulnerability is identified as CVE-2008-6241. The attack can be executed remotely. Additionally, an exploit exists.

Detailsinfo

A vulnerability was found in China-on-site FlexPHPSite 0.0.1/0.0.7. It has been classified as critical. Affected is an unknown code block. The manipulation of the argument checkpass with an unknown input leads to a sql injection vulnerability. CWE is classifying the issue as CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Multiple SQL injection vulnerabilities in admin/usercheck.php in FlexPHPSite 0.0.1 and 0.0.7, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via (1) the checkuser parameter (aka username field), or (2) the checkpass parameter (aka password field), to admin/index.php.

The weakness was released 02/23/2009 (Website). The advisory is shared for download at milw0rm.com. This vulnerability is traded as CVE-2008-6241 since 02/23/2009. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details and a public exploit are known. The MITRE ATT&CK project declares the attack technique as T1505.

A public exploit has been developed by x0r and been published even before and not after the advisory. The exploit is shared for download at exploit-db.com. It is declared as highly functional. The vulnerability was handled as a non-public zero-day exploit for at least 56 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at X-Force (47643), Exploit-DB (7615) and Secunia (SA33347†). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• China-on-site

Name

• FlexPHPSite

Version

• 0.0.1
• 0.0.7

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion