Vulnerabilities > CVE-2003-0025 - SQL Injection vulnerability in Horde IMP Database Files

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# This plugin text was extracted from SuSE Security Advisory SUSE-SA:2003:0008
#


if ( ! defined_func("bn_random") ) exit(0);

include("compat.inc");

if(description)
{
 script_id(13773);
 script_bugtraq_id(6559);
 script_version ("1.14");
 script_cve_id("CVE-2003-0025");
 
 name["english"] = "SUSE-SA:2003:0008: imp";
 
 script_name(english:name["english"]);
 
 script_set_attribute(attribute:"synopsis", value:
"The remote host is missing a vendor-supplied security patch" );
 script_set_attribute(attribute:"description", value:
"The remote host is missing the patch for the advisory SUSE-SA:2003:0008 (imp).


IMP is a well known PHP-based web-mail system.
Some SQL-injection vulnerabilities were found in  IMP 2.x that
allow an attacker to access the underlying database. No authentication
is needed to exploit this bug.
An attacker can gain access to protected information or, in conjunction
with PostgreSQL, execute shell commands remotely.

There is no temporary fix known. Please install the new packages from
our FTP servers.

Please download the update package for your distribution and verify its
integrity by the methods listed in section 3) of this announcement.
Then, install the package using the command 'rpm -Fhv file.rpm' to apply
the update." );
 script_set_attribute(attribute:"solution", value:
"http://www.suse.de/security/2003_008_imp.html" );
 script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
 script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
 script_set_attribute(attribute:"exploitability_ease", value:"No exploit is required");
 script_set_attribute(attribute:"exploit_available", value:"true");




 script_set_attribute(attribute:"plugin_publication_date", value: "2004/07/25");
 script_cvs_date("Date: 2019/10/25 13:36:27");
 script_end_attributes();

 
 summary["english"] = "Check for the version of the imp package";
 script_summary(english:summary["english"]);
 
 script_category(ACT_GATHER_INFO);
 
 script_copyright(english:"This script is Copyright (C) 2004-2019 Tenable Network Security, Inc.");
 family["english"] = "SuSE Local Security Checks";
 script_family(english:family["english"]);
 
 script_dependencies("ssh_get_info.nasl");
 script_require_keys("Host/SuSE/rpm-list");
 exit(0);
}

include("rpm.inc");
if ( rpm_check( reference:"imp-2.2.6-247", release:"SUSE7.3") )
{
 security_hole(0);
 exit(0);
}
if ( rpm_check( reference:"imp-2.2.6-246", release:"SUSE8.0") )
{
 security_hole(0);
 exit(0);
}
if ( rpm_check( reference:"imp-2.2.6-248", release:"SUSE8.1") )
{
 security_hole(0);
 exit(0);
}
if (rpm_exists(rpm:"imp-", release:"SUSE7.3")
 || rpm_exists(rpm:"imp-", release:"SUSE8.0")
 || rpm_exists(rpm:"imp-", release:"SUSE8.1") )
{
 set_kb_item(name:"CVE-2003-0025", value:TRUE);
}

#
# (C) Tenable Network Security, Inc.
#

# Date: Thu, 9 Jan 2003 00:50:48 +0200 (EET)
# From: Jouko Pynnonen <[email protected]>
# To: <[email protected]>
# Subject: [VulnWatch] IMP 2.x SQL injection vulnerabilities


include("compat.inc");

if (description)
{
 script_id(11488);
 script_version("1.21");
 script_cvs_date("Date: 2018/11/15 20:50:17");

 script_cve_id("CVE-2003-0025");
 script_bugtraq_id(6559);

 script_name(english:"Horde IMP mailbox.php3 Multiple Parameter SQL Injection");
 script_summary(english:"Checks IMP version");

 script_set_attribute(attribute:"synopsis", value:
"The remote web server is running a PHP application that is affected by
multiple sql injection vulnerabilities.");
 script_set_attribute(attribute:"description", value:
"The remote server is running IMP, a web-based mail client.  There is a
bug in the installed version which allows an attacker to perform a SQL
injection attack using the 'actionID' parameter of the 'mailbox.php3'
script.

An attacker may use this flaw to gain unauthorized access to a user
mailbox or to take the control of the remote database.");
 script_set_attribute(attribute:"see_also", value:"https://marc.info/?l=bugtraq&m=104204786206563&w=2");
 script_set_attribute(attribute:"solution", value:
"IMP 2.x is deprecated. Update to IMP 3.x or 4.x.");
 script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
 script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
 script_set_attribute(attribute:"exploitability_ease", value:"No exploit is required");
 script_set_attribute(attribute:"exploit_available", value:"true");

 script_set_attribute(attribute:"plugin_publication_date", value:"2003/03/27");
 script_set_attribute(attribute:"vuln_publication_date", value:"2003/01/08");

 script_set_attribute(attribute:"plugin_type", value:"remote");
 script_set_attribute(attribute:"cpe", value:"cpe:/a:horde:imp");
 script_end_attributes();

 script_category(ACT_GATHER_INFO);
 script_copyright(english:"This script is Copyright (C) 2003-2018 Tenable Network Security, Inc.");
 script_family(english:"CGI abuses");

 script_dependencie("find_service1.nasl", "http_version.nasl");
 script_require_ports("Services/www", 80);
 script_exclude_keys("Settings/disable_cgi_scanning");
 script_require_keys("www/PHP");
 exit(0);
}


include("global_settings.inc");
include("misc_func.inc");
include("http.inc");

port = get_http_port(default:80, php: 1);


dirs = make_list(cgi_dirs(), "/imp", "/horde/imp");
foreach d (dirs)
{
  u = strcat(d, "/mailbox.php3?actionID=6&server=x&imapuser=x';somesql&pass=x");
  res = http_send_recv3(method:"GET", item: u, port:port, exit_on_fail: 1);

  if('parse error at or near "somesql"' >< res[2])
  {
    if (report_verbosity < 1)
      security_hole(port:port);
    else
      security_hole(port: port, extra:
'\nThe following URL will expose the flaw !:\n\n' +
  build_url(port: port, qs: u));
   set_kb_item(name:'www/'+port+'/SQLInjection', value:TRUE);
   exit(0);
  }
}
exit(0, "No vulnerable CGI was found on port "+port+".");

#%NASL_MIN_LEVEL 80502

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Debian Security Advisory DSA-229. The text 
# itself is copyright (C) Software in the Public Interest, Inc.
#

include("compat.inc");

if (description)
{
  script_id(15066);
  script_version("1.21");
  script_cvs_date("Date: 2019/08/02 13:32:17");

  script_cve_id("CVE-2003-0025");
  script_bugtraq_id(6559);
  script_xref(name:"DSA", value:"229");

  script_name(english:"Debian DSA-229-1 : imp - SQL injection");
  script_summary(english:"Checks dpkg output for the updated package");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Debian host is missing a security-related update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Jouko Pynnonen discovered a problem with IMP, a web-based IMAP mail
program. Using carefully crafted URLs a remote attacker is able to
inject SQL code into SQL queries without proper user authentication.
Even though results of SQL queries aren't directly readable from the
screen, an attacker might update their mail signature to contain
wanted query results and then view it on the preferences page of IMP.

The impact of SQL injection depends heavily on the underlying database
and its configuration. If PostgreSQL is used, it's possible to execute
multiple complete SQL queries separated by semicolons. The database
contains session id's so the attacker might hijack sessions of people
currently logged in and read their mail. In the worst case, if the
hordemgr user has the required privilege to use the COPY SQL command
(found in PostgreSQL at least), a remote user may read or write to any
file the database user (postgres) can. The attacker may then be able
to run arbitrary shell commands by writing them to the postgres user's
~/.psqlrc; they'd be run when the user starts the psql command which
under some configurations happens regularly from a cron script."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.debian.org/security/2003/dsa-229"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"Upgrade the IMP packages.

For the current stable distribution (woody) this problem has been
fixed in version 2.2.6-5.1.

For the old stable distribution (potato) this problem has been fixed
in version 2.2.6-0.potato.5.1."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No exploit is required");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:imp");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:2.2");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:3.0");

  script_set_attribute(attribute:"patch_publication_date", value:"2003/01/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2004/09/29");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2004-2019 Tenable Network Security, Inc.");
  script_family(english:"Debian Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}


include("audit.inc");
include("debian_package.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;
if (deb_check(release:"2.2", prefix:"imp", reference:"2.2.6-0.potato.5.1")) flag++;
if (deb_check(release:"3.0", prefix:"imp", reference:"2.2.6-5.1")) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());
  else security_hole(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");