SQL Injection en Plesk

[Seguridad Cero]

¿Alguien tiene información sobre el último fallo de seguridad para paneles Plesk?

Lo que sé que se ha publicado es esto:

DESCRIPTION:
A vulnerability has been reported in Plesk, which can be exploited by
malicious people to conduct SQL injection attacks.

Input passed to the "PLESKSESSID" cookie is not properly sanitised in
auth.php3 before being used in SQL queries. This can be exploited to
manipulate SQL queries by injecting arbitrary SQL code.

The vulnerability is reported in Plesk for Windows versions 7.6.1,
8.1.0, 8.1.1, and 8.2.0.

Pero sería interesante conocer info más detallada de cómo se reproduce.

[Nico Montezco]

SYMPTOMS
SQL injection vulnerability within Plesk for Linux/Unix.


RESOLUTION
SWsoft Plesk versions 7.5.4, 8.1.1, 8.2.1 and later are not affected by this vulnerability.

For other Plesk versions please download the following file:

For Plesk v8.0.0 and v8.0.1 :
http://download1.swsoft.com/Plesk/Hotfix/PleskUnix/8.0.1/114298/cla...
MD5 (class.Session.php) = 4d917ed483cbf030fb122a1e214b2bbf

For Plesk v8.1.0 :
http://download1.swsoft.com/Plesk/Hotfix/PleskUnix/8.1.0/114298/cla...
MD5 (class.Session.php) = 4de3b2fc50011d27fb13e5a293720100

For Plesk 8.2.0 :
http://download1.swsoft.com/Plesk/Hotfix/PleskUnix/8.2.0/114298/cla...
MD5 (class.Session.php) = 5b7a8071374aa94b83697aec72d1d556

and replace /usr/local/psa/admin/plib/class.Session.php file on Plesk server with the downloaded new one. Make sure that md5sum and permissions of the file are correct, for example:


# wget http://download1.swsoft.com/Plesk/Hotfix/PleskUnix/8.2.0/114298/cla...

# md5sum ./class.Session.php
MD5 (./class.Session.php) = 5b7a8071374aa94b83697aec72d1d556

# cp /usr/local/psa/admin/plib/class.Session.php /usr/local/psa/admin/plib/class.Session.php.old

# cp ./class.Session.php /usr/local/psa/admin/plib/class.Session.php

# chmod 644 /usr/local/psa/admin/plib/class.Session.php

# chown root:psaadm /usr/local/psa/admin/plib/class.Session.php

# /usr/local/psa/admin/bin/httpsdctl restart


ps: EL Exploit aun no es publico por obvias razones =:)

[juan miguel de la vega gomez]

Las inyecciones de sql funcionan todas de la misma forma, poniendo en los campos de logueo sentencias que siempre sean ciertas. Hay un video muy bueno, si lo encuentro pongo el link.