74 lines
No EOL
1.9 KiB
Text
74 lines
No EOL
1.9 KiB
Text
Advisory: SQL injection vulnerability in Pragyan CMS v.3.0
|
||
Advisory ID: SROEADV-2015-11
|
||
Author: Steffen Rösemann
|
||
Affected Software: Pragyan CMS v.3
|
||
Vendor URL: https://github.com/delta/pragyan, http://delta.nitt.edu/
|
||
Vendor Status: vendor did not respond after initial communication
|
||
CVE-ID: -
|
||
|
||
==========================
|
||
Vulnerability Description:
|
||
==========================
|
||
|
||
Pragyan CMS v. 3 suffers from a SQL injection vulnerability that can be
|
||
abused even by unauthenticated attackers.
|
||
|
||
==================
|
||
Technical Details:
|
||
==================
|
||
|
||
The user-profile of registered users of Pragyan CMS v.3 is vulnerable to
|
||
SQL injection attacks. A user-profile can be found in the following
|
||
location of a common Pragyan CMS installation:
|
||
|
||
http://{TARGET}/user:1
|
||
|
||
Exploit-Example:
|
||
|
||
http://
|
||
{TARGET}/user:1%27+and+1=2+union+select+database%28%29,version%28%29,3+--+
|
||
|
||
|
||
|
||
=========
|
||
Solution:
|
||
=========
|
||
|
||
Vendor notified, did not respond after initial communication.
|
||
|
||
If you use Pragyan CMS v.3, please locate the file userprofile.lib.php and
|
||
use my patch (see [5], usage at your own risk!).
|
||
|
||
|
||
|
||
|
||
====================
|
||
Disclosure Timeline:
|
||
====================
|
||
18-Jan-2015 – found the vulnerability
|
||
19-Jan-2015 - informed the developers (see [3])
|
||
19-Jan-2015 – release date of this security advisory [without technical
|
||
details]
|
||
19-Jan-2015 - forked the project to keep it available/researchable in its
|
||
current state for other researchers [4]
|
||
03-Feb-2015 - release date of this security advisory
|
||
03-Feb-2015 - provided a patch for vulnerability (see [5])
|
||
03-Feb-2015 - send to FullDisclosure
|
||
|
||
|
||
|
||
========
|
||
Credits:
|
||
========
|
||
|
||
Vulnerability found and advisory written by Steffen Rösemann.
|
||
|
||
===========
|
||
References:
|
||
===========
|
||
|
||
[1] http://delta.nitt.edu/ / https://github.com/delta/pragyan
|
||
[2] http://sroesemann.blogspot.de/2015/01/sroeadv-2015-11.html
|
||
[3] https://github.com/delta/pragyan/issues/206
|
||
[4] https://github.com/sroesemann/pragyan
|
||
[5] http://pastebin.com/ip2gGYuS |