Description
Directory traversal vulnerability in SQL-Ledger, and LedgerSMB before 1.1.5, allows remote attackers to read and overwrite arbitrary files, and execute arbitrary code, via . (dot) characters adjacent to (1) users and (2) users/members strings, which are removed by blacklisting functions that filter these strings and collapse into .. (dot dot) sequences.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | sql-ledger | No fix yet | — |
| Debian 13 | sql-ledger | No fix yet | — |
| Debian 12 | sql-ledger | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | sql-ledger | No fix yet | — |
References
- 24363 third-party-advisory
- 33619 vdb-entry
- 33621 vdb-entry
- 20070301 Full disclosure: Directory Transversal and Arbitrary Code Execution Vulnerability in SQL-Ledger and LedgerSMB mailing-list
- 2381 third-party-advisory
- 24366 third-party-advisory
- sqlledger-userpathmemberfile-dir-traversal(32776) vdb-entry
- 1017715 vdb-entry