Multiple vulnerabilities in postfixadmin

By | 2017-10-26T13:06:49+00:00 26 January 2012|Tags: |
Advisory ID:CSA-12002
Title:Multiple vulnerabilities in postfixadmin
Version:2.3.4 and probably prior
Vulnerability type:SQL injection, XSS
Risk level:2 / 3
CVE:CVE-2012-0811, CVE-2012-0812
Vendor notification:2012-01-10
Vendor Fix:2012-01-26
Public disclosure:2012-01-26


postfixadmin version 2.3.4 and probably below suffers from multiple vulnerabilities:

1) SQL injection in pacrypt function: if postfixadmin is configured with ‘mysql_encrypt’ the pacrypt function passes the $pw parameter to sql query without santitzing it allowing non-admin users to perform sql injection attacks.

2) SQL injection in sql dump generated by backup.php: the backup.php file generates sql queries without sanitizing values. A non-admin user can inject arbitrary sql commands into backup file that will be executed when an admin restores that backup. To test this issue try to set the vacation message of any user to:

dontcare','','','2012-01-09 17:34:06','1');
INSERT INTO admin (username,password,created,modified,active) 
VALUES ('','$1$2cab7a19$zIuOsr6PXksCu13883fVg/','2012-01-08 15:48:1','2012-01-09 17:17:0','1'); #

then take a backup and restore it, the new admin is added to admin table.

3) Cross Site Scripting in edit-vacation.php: Input passed via domain GET parameter to edit-vacation.php is not properly sanitised before being returned to the user.</script><script>alert(1);</script>

4) Cross Site Scripting in edit-vacation.php: Input passed via fDomain POST parameter to create-domain.php is not properly sanitised before being returned to the user.
This is interesting because the fDomain variable is passed to strip_tags so something like on<a>click is trasformed to onclik. This allows to bypass browsers builtin XSS protection.
To test this issue put the following string as Domain parameter in create-domain.php, submit the form and then click on Domain’s input text..

dontcare" oncli<a>ck=alert(document.cookie);//

5) Other XSS on POST vars: to exploit them you need to perform a CSRF attack that can leat to arbitrary data inserted into db insted of just a script executed in the browser.

create-alias.php and edit-alias.php

Description: <script>alert(1)</script>

create-mailbox.php and edit-mailbox.php
Name: <script>alert(1)</script>

Server: <script>alert(1)</script>

these xss (except the first one) are saved into db (ie fetchmail.php saves <script>alert(1)</script> as server name). This means that even if a remote attacker must perform a CSRF to exploit these XSS,a malicious admin can insert scripts into db that get executed when other admins load a list (ie list-virtual.php)



upgrade to postfixadmin 2.3.5