Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Summary
Title Subrion CMS vulnerable to SQL injection by an authenticated user
Informations
Name VU#110532 First vendor Publication 2015-05-08
Vendor VU-CERT Last vendor Modification 2015-05-08
Severity (Vendor) N/A Revision M

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:S/C:P/I:P/A:P)
Cvss Base Score 6.5 Attack Range Network
Cvss Impact Score 6.4 Attack Complexity Low
Cvss Expoit Score 8 Authentication Requires single instance
Calculate full CVSS 2.0 Vectors scores

Detail

Vulnerability Note VU#110532

Subrion CMS vulnerable to SQL injection by an authenticated user

Original Release date: 08 May 2015 | Last revised: 08 May 2015

Overview

Subrion CMS is vulnerable to SQL injection from authenticated users when a browser cookie is modified in a certain way.

Description

Subrion is an open source web-based content management system (CMS). Subrion is vulnerable to SQL injection due to deserialization of untrusted data from a browser cookie.

CWE-502: Deserialization of Untrusted Data
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Upon user login, Subrion attempts to locate a cookie named salt and deserialize the cookie for use in SQL UPDATE statements when interacting with Subrion. Modifying this cookie in a certain way may result in arbitrary SQL statements being executed on Subrion's underlying database.

This issue is verified in version 3.3.0. Other versions prior to 3.3.3 may also be affected. The reporter suggests versions as early as 3.1.1 may be affected.

Impact

An authenticated remote user may execute arbitrary SQL statements on Subrion's database.

Solution

Apply an update

Subrion has released version 3.3.3 addressing this issue. Affected users are encouraged to update as soon as possible.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate Updated
SubrionAffected03 Apr 201520 Apr 2015
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

GroupScoreVector
Base9.0AV:N/AC:L/Au:S/C:C/I:C/A:C
Temporal7.0E:POC/RL:OF/RC:C
Environmental5.3CDP:ND/TD:M/CR:ND/IR:ND/AR:ND

References

  • http://www.subrion.org/forums/threads/subrion-cms-3-3-3-is-available.2024/

Credit

Thanks to Jack Baker for reporting this vulnerability to us, and to Subrion for quickly addressing this issue.

This document was written by Garret Wassermann.

Other Information

  • CVE IDs:Unknown
  • Date Public:27 Apr 2015
  • Date First Published:08 May 2015
  • Date Last Updated:08 May 2015
  • Document Revision:46

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Original Source

Url : http://www.kb.cert.org/vuls/id/110532

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-89 Improper Sanitization of Special Elements used in an SQL Command ('SQL Injection') (CWE/SANS Top 25)

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 3

Alert History

If you want to see full details history, please login or register.
0
1
2
Date Informations
2015-07-09 17:29:56
  • Multiple Updates
2015-07-05 17:28:44
  • Multiple Updates
2015-05-08 17:24:59
  • First insertion