Hallo,
wir haben unsere Webseite bei unserem Provider mit Sitelock geprüft und erhalten nun eine Warnmeldung bezüglich des e-Mail-Scriptes.
Liegt das an dem Script von Zeta? Was kann man hier tun?
Grüße Frank
http://www.schall.de
ZP 13.1 Business
Synopsis: A CGI application hosted on the remote web server is potentially prone to SQL injection attack.
Beschreibung: By sending specially crafted parameters to one or more CGI scripts hosted on the remote web server, SiteLock was able to get a very different response, which suggests that it may have been able to modify the behavior of the application and directly access the underlying database.
An attacker may be able to exploit this issue to bypass authentication, read confidential data, modify the remote database, or even take control of the remote operating system.
Note that this script is experimental and may be prone to false positives.
Solution: Modify the affected CGI scripts so that they properly escape arguments.
Technical Details:
Using the GET HTTP method, SiteLock found that :+ The following resources may be vulnerable to blind SQL injection :+ The 'f_receiver' parameter of the //assets/php/formmailer/SendEmail.php CGI ://assets/php/formmailer/SendEmail.php?url=&f_invalidEmailMsg=keine%20g%c3%bcltige%20E-Mail&f_id=1682&f_error=http%3a%2f%2fwww.schall.de%2fsystem%2fnachricht-konnte-nicht-versendet-werden.html&f_alertPrefix=Bitte%20f%c3%bcllen%20Sie%20die%20rot%20markierten%20Felder%20aus%3a&NAME9=Textnachricht%20(optional)&NAME2=Name&NAME1=Objektbezeichnung&F9=&F8=&F7=&F6=&F1=&F2=&F3=&F4=&F5=&NAME3=Vorname&NAME4=e-Mail&NAME5=Textnachricht&NAME6=Textnachricht&NAME7=Stra%c3%9fe%2c%20Hausnummer&NAME8=Telefon%20(optional)&f_success=http%3a%2f%2fwww.schall.de%2fsystem%2fnachricht-erfolgreich-gesendet.html&f_title=Anfrage%20%c3%bcber%20www.schall.de&sc=&f_receiver=qmVf0CWGlXHMq9A%2fMiIUqQ%3d%3dzz&f_invalidEmailMsg=keine%20g%c3%bcltige%20E-Mail&f_id=1682&f_error=http%3a%2f%2fwww.schall.de%2fsystem%2fnachricht-konnte-nicht-versendet-werden.html&f_alertPrefix=Bitte%20f%c3%bcllen%20Sie%20die%20rot%20markierten%20Felder%20aus%3a&NAME9=Textnachricht%20(optional)&NAME2=Name&NAME1=Objektbezeichnung&F9=&F8=&F7=&F6=&F1=&F2=&F3=&F4=&F5=&NAME3=Vorname&NAME4=e-Mail&NAME5=Textnachricht&NAME6=Textnachricht&NAME7=Stra%c3%9fe%2c%20Hausnummer&NAME8=Telefon%20(optional)&f_success=http%3a%2f%2fwww.schall.de%2fsystem%2fnachricht-erfolgreich-gesendet.html&f_title=Anfrage%20%c3%bcber%20www.schall.de&sc=&f_receiver=qmVf0CWGlXHMq9A%2fMiIUqQ%3d%3dyy-------- output --------HTTP/1.1 302 Found-------- vs --------HTTP/1.1 200 OK------------------------+ The 'f_receiver' parameter of the /assets/php/formmailer/SendEmail.php CGI :/assets/php/formmailer/SendEmail.php?url=&f_invalidEmailMsg=keine%20g%c3%bcltige%20E-Mail&f_id=1682&f_error=http%3a%2f%2fwww.schall.de%2fsystem%2fnachricht-konnte-nicht-versendet-werden.html&f_alertPrefix=Bitte%20f%c3%bcllen%20Sie%20die%20rot%20markierten%20Felder%20aus%3a&NAME9=Textnachricht%20(optional)&NAME2=Name&NAME1=Objektbezeichnung&F9=&F8=&F7=&F6=&F1=&F2=&F3=&F4=&F5=&NAME3=Vorname&NAME4=e-Mail&NAME5=Textnachricht&NAME6=Textnachricht&NAME7=Stra%c3%9fe%2c%20Hausnummer&NAME8=Telefon%20(optional)&f_success=http%3a%2f%2fwww.schall.de%2fsystem%2fnachricht-erfolgreich-gesendet.html&f_title=Anfrage%20%c3%bcber%20www.schall.de&sc=&f_receiver=qmVf0CWGlXHMq9A%2fMiIUqQ%3d%3dzz&f_invalidEmailMsg=keine%20g%c3%bcltige%20E-Mail&f_id=1682&f_error=http%3a%2f%2fwww.schall.de%2fsystem%2fnachricht-konnte-nicht-versendet-werden.html&f_alertPrefix=Bitte%20f%c3%bcllen%20Sie%20die%20rot%20markierten%20Felder%20aus%3a&NAME9=Textnachricht%20(optional)&NAME2=Name&NAME1=Objektbezeichnung&F9=&F8=&F7=&F6=&F1=&F2=&F3=&F4=&F5=&NAME3=Vorname&NAME4=e-Mail&NAME5=Textnachricht&NAME6=Textnachricht&NAME7=Stra%c3%9fe%2c%20Hausnummer&NAME8=Telefon%20(optional)&f_success=http%3a%2f%2fwww.schall.de%2fsystem%2fnachricht-erfolgreich-gesendet.html&f_title=Anfrage%20%c3%bcber%20www.schall.de&sc=&f_receiver=qmVf0CWGlXHMq9A%2fMiIUqQ%3d%3dyy-------- output --------HTTP/1.1 302 Found-------- vs --------HTTP/1.1 200 OK------------------------