----------------------------------------------------------------------

Secunia customers receive relevant and filtered advisories.
Delivery is done via different channels including SMS, Email, Web,
and https based XML feed.
http://corporate.secunia.com/trial/38/request/

----------------------------------------------------------------------

TITLE:
MediaBeez "server.php" SQL Execution Vulnerability

SECUNIA ADVISORY ID:
SA24954

VERIFY ADVISORY:
http://secunia.com/advisories/24954/

CRITICAL:
Less critical

IMPACT:
Manipulation of data, Exposure of sensitive information

WHERE:
>From remote

SOFTWARE:
MediaBeez 0.x
http://secunia.com/product/14003/

DESCRIPTION:
HACKERS PAL has reported a security issue in MediaBeez, which can be
exploited by malicious people to disclose sensitive information and
to execute arbitrary SQL code.

The problem is caused due to the presence of the insecure
"php/adodb/server.php" test script. This can be exploited to execute
arbitrary SQL code with full MySQL database privileges via the "sql"
parameter.

Successful exploitation requires that the MySQL password for the root
user is empty.

The vulnerability is related to vulnerability #1 in:
SA17418

The vulnerability is reported in version 0.7.3. Other versions may
also be affected.

SOLUTION:
Remove the "server.php" test script from production systems.

PROVIDED AND/OR DISCOVERED BY:
HACKERS PAL

OTHER REFERENCES:
SA17418:
http://secunia.com/advisories/17418/

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------