MailWatch authenticate() Function SQL Injection

medium Nessus Plugin ID 20176

Language:

Synopsis

The remote web server contains a PHP application that is prone to SQL injection attacks.

Description

The remote host appears to be running MailWatch, a web-based frontend to MailScanner written in PHP.

The version of MailWatch installed on the remote host fails to sanitize the username and password before using them in database queries in the 'authenticate' function of 'functions.php'. This issue can be exploited, if PHP's 'magic_quotes' setting is disabled, to launch SQL injection attacks against the affected application to, for example, bypass authentication and thereby gain administrative access to the application.

Solution

Upgrade to MailWatch 1.0.3 or later.

Plugin Details

Severity: Medium

ID: 20176

File Name: mailwatch_authenticate_sql_injection.nasl

Version: 1.19

Type: remote

Family: CGI abuses

Published: 11/10/2005

Updated: 4/11/2022

Configuration: Enable thorough checks (optional)

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.8

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

Vulnerability Information

Required KB Items: www/PHP

Excluded KB Items: Settings/disable_cgi_scanning

Exploit Available: true

Exploit Ease: No exploit is required

Vulnerability Publication Date: 11/2/2005

Reference Information

CVE: CVE-2005-3470

BID: 15278

Detections

Analytics