SECV-05-1402 - Reportico software admin credentials leak
Product description:
Reportico is a comprehensive Open Source web reporting tool written
purely in PHP. Reportico provides a web-based front end screen for
designing and viewing reports stored in XML format. Reportico supports
flexible criteria selection and reports may be presented in HTML, PDF,
CSV, XML and JSON formats. Groups, graphs, expressions and drilldowns
are also easily incorporated and reports may be embedded into existing
web pages with a few lines of PHP.
CVE-ID: CVE-2014-3777
Affected versions: All versions prior to 4.0 including plugins
Vendor url:http://www.reportico.org
Vulnerability status: Fixed
Advisory url: http://www.secveritas.com/
Vulnerability details:
By loading the admin template an attacker could access all information
for a report including database credentials and admin password for the
report.
This could be obtained due lack of proper check of the URL parameter
xmlin. By changing the parameter in the HTTP request to
xmlin=../admin/
administration.
Timeline:
13th May 14 - First contact with reportico.org developer
15th May 14 - Vulnerability reported with evidences and full problem
description and fix proposal
18th May 14 - Correction of the problem following proposal from SECVeritas
20th May 14 - New version made available for re-testing
21st May 14 - New version tested some sugestions made for improvement
1st Jun 14 - Final version created by developer, waiting for release
28th Jun 14 - Public disclosure of the vulnerability.
Credits:
ms - secveritas.com
2014
Product description:
Reportico is a comprehensive Open Source web reporting tool written
purely in PHP. Reportico provides a web-based front end screen for
designing and viewing reports stored in XML format. Reportico supports
flexible criteria selection and reports may be presented in HTML, PDF,
CSV, XML and JSON formats. Groups, graphs, expressions and drilldowns
are also easily incorporated and reports may be embedded into existing
web pages with a few lines of PHP.
CVE-ID: CVE-2014-3777
Affected versions: All versions prior to 4.0 including plugins
Vendor url:http://www.reportico.org
Vulnerability status: Fixed
Advisory url: http://www.secveritas.com/
Vulnerability details:
By loading the admin template an attacker could access all information
for a report including database credentials and admin password for the
report.
This could be obtained due lack of proper check of the URL parameter
xmlin. By changing the parameter in the HTTP request to
xmlin=../admin/
administration.
Timeline:
13th May 14 - First contact with reportico.org developer
15th May 14 - Vulnerability reported with evidences and full problem
description and fix proposal
18th May 14 - Correction of the problem following proposal from SECVeritas
20th May 14 - New version made available for re-testing
21st May 14 - New version tested some sugestions made for improvement
1st Jun 14 - Final version created by developer, waiting for release
28th Jun 14 - Public disclosure of the vulnerability.
Credits:
ms - secveritas.com
2014