In association with heise online

12 March 2008, 09:09

Several vulnerabilities in Mapbender map software

  • Twitter
  • Facebook
  • submit to slashdot
  • StumbleUpon
  • submit to reddit

The Mapbender map application contains several vulnerabilities that can be exploited to examine the database contents and manipulate them or to take control of the server. The software is a geodata collection server using a web service interface to the Open Geospatial Consortium (OGC) standard. Inadequate filtering of user parameters in the mapFiler.php script makes it possible to write arbitrary PHP scripts in a file on the server and execute them.

Security services provider RedTeam Pentesting describes a demo exploit in its vulnerability report. RedTeam also found SQL injection holes in several Mapbender scripts which allow user names and the corresponding password hashes to be read. The errors occur in version 2.4.4. Previous versions are also likely to contain them. Updating to version 2.4.5 RC1 (ZIP file) should remedy the problem, although the changelog that accompanies the update makes no reference to any possible security problems.

See also:


Print Version | Send by email | Permalink:

  • July's Community Calendar

The H Open

The H Security

The H Developer

The H Internet Toolkit