----------------------------------------------------------------------

Want to join the Secunia Security Team?

Secunia offers a position as a security specialist, where your daily
work involves reverse engineering of software and exploit code,
auditing of source code, and analysis of vulnerability reports.

http://secunia.com/secunia_security_specialist/

----------------------------------------------------------------------

TITLE:
CMS Mundo SQL Injection and File Upload Vulnerabilities

SECUNIA ADVISORY ID:
SA20362

VERIFY ADVISORY:
http://secunia.com/advisories/20362/

CRITICAL:
Highly critical

IMPACT:
Manipulation of data, System access

WHERE:
>From remote

SOFTWARE:
CMS Mundo 1.x
http://secunia.com/product/10156/

DESCRIPTION:
Secunia Research has discovered two vulnerabilities in CMS Mundo,
which can be exploited by malicious people to conduct SQL injection
attacks and compromise a vulnerable system.

1) Input passed to the "username" parameter in "controlpanel/" during
login isn't properly sanitised before being used in a SQL query. This
can be exploited to manipulate SQL queries by injecting arbitrary SQL
code.

This can further be exploited to bypass the authentication process
and access the administration section.

Successful exploitation requires that "magic_quotes_gpc" is
disabled.

2) An input validation error in the image upload handling in the
image gallery can be exploited to upload arbitrary PHP scripts to a
predictable location inside the web root.

Successful exploitation requires access to the administration
section.

A combination of vulnerabilities #1 and #2 can be exploited by a
malicious person to execute arbitrary PHP code on a vulnerable
system.

The vulnerabilities have been confirmed in version 1.0 build 007.
Prior versions may also be affected.

SOLUTION:
Update to version 1.0 build 008.

PROVIDED AND/OR DISCOVERED BY:
Andreas Sandblad, Secunia Research

ORIGINAL ADVISORY:
Secunia Research:
http://secunia.com/secunia_research/2006-43/advisory/

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------