TITLE:
IP3 Networks NA75 SQL Injection Vulnerability and Weaknesses

SECUNIA ADVISORY ID:
SA19818

VERIFY ADVISORY:
http://secunia.com/advisories/19818/

CRITICAL:
Less critical

IMPACT:
Security Bypass, Manipulation of data, Exposure of sensitive
information, Privilege escalation

WHERE:
>From local network

OPERATING SYSTEM:
IP3 Networks NA75
http://secunia.com/product/9602/

DESCRIPTION:
Ralph Moonen has reported a vulnerability and some weaknesses in IP3
Networks NA75, which can be exploited by malicious, local users to
potentially gain escalated privileges and disclose or manipulate
sensitive information, or by malicious people to conduct SQL
injection attacks.

1) Some input passed in the web interface is not properly sanitised
before being used in a SQL query. This can be exploited to manipulate
SQL queries by injecting arbitrary SQL code.

Example:
* The password field during login.

2) Some input validation errors in the command line interface can be
exploited to inject arbitrary shell commands via the "`" backtick
character.

3) The shadow password file has world-readable permissions, which can
be exploited to disclose other users' encrypted passwords.

4) The database file is stored with world-readable and world-writable
permissions.

The vulnerability and weaknesses have been reported in firmware
version 4.0.34. Other versions may also be affected.

SOLUTION:
Apply patch available from the vendor.
http://www.ip3.com/supportoverview.htm

PROVIDED AND/OR DISCOVERED BY:
Ralph Moonen

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------