183 lines
No EOL
7.8 KiB
Text
183 lines
No EOL
7.8 KiB
Text
Title:
|
||
======
|
||
PG Dating Pro v1.0 CMS - Multiple Web Vulnerabilities
|
||
|
||
|
||
Date:
|
||
=====
|
||
2012-10-29
|
||
|
||
|
||
References:
|
||
===========
|
||
http://www.vulnerability-lab.com/get_content.php?id=736
|
||
|
||
|
||
VL-ID:
|
||
=====
|
||
736
|
||
|
||
|
||
Common Vulnerability Scoring System:
|
||
====================================
|
||
8.5
|
||
|
||
|
||
Introduction:
|
||
=============
|
||
Professional online dating script is a basis for a successful online dating, community and personals business.
|
||
Dating Pro is readymade PHP online dating software for everyone. Our dating web site software can be used to create your own dating,
|
||
personals, social dating, adult & matrimonial sites. Flexible source codes and fully equipped dating software package makes a
|
||
vivid site for your community.
|
||
|
||
Get the best from dating software industry – we are constantly reviewing latest trends, online dating news & innovations in online dating
|
||
industry to implement them into our dating script. We listen to what our customers and non-customers say. We provide regular updates for
|
||
dating website software to make your business prosperous!
|
||
|
||
Get stuff done quickly – we provide free installation, free support, manuals and videos on how to manage your site more effectively!
|
||
Own & promote your brand instantly. Personalize user profiles & site texts, adjust design styles & upload your own logo, change copyrights,
|
||
add your SEO meta tags. Use hosting and customization services any time you need them. We know that you have great ideas and don’t have time
|
||
to deal with coding and setup. You don’t need to. Our customization & hosting teams do their best to satisfy your needs.
|
||
Find everything in one package. Users online are very selective. You need to look & feel like a reputable dating site from the start. The
|
||
package has options your users would expect: Chats, P2P messenger, messages, kisses, memberships, searches, profiles, ratings, galleries, forum,
|
||
blogs, groups, events… you name it.
|
||
|
||
Mind your budget & requirements. Check different pricing schemes. Choose the right one among our `all modules`, `open source , `multi-license`,
|
||
`partial payments` and “all inclusive` offers. It’s not about money. Your satisfaction is our main goal!
|
||
It’s pleasure for us to serve your business! Try PG Dating Pro today!
|
||
|
||
|
||
|
||
Abstract:
|
||
=========
|
||
The Vulnerability Laboratory Research Team discovered multiple Web Vulnerabilities in PG Dating Pro v1.0 CMS.
|
||
|
||
|
||
Report-Timeline:
|
||
================
|
||
2012-10-29: Public Disclosure
|
||
|
||
|
||
Status:
|
||
========
|
||
Published
|
||
|
||
|
||
Exploitation-Technique:
|
||
=======================
|
||
Remote
|
||
|
||
|
||
Severity:
|
||
=========
|
||
Critical
|
||
|
||
|
||
Details:
|
||
========
|
||
1.1
|
||
A remote SQL Injection vulnerability is detected in the PG Dating Pro v1.0 CMS, turnkey PHP dating software to start internet dating service.
|
||
The vulnerability allows an attacker (remote) or local low privileged user account to execute a SQL commands on the affected application dbms.
|
||
The sql injection vulnerability is located in events.php file with the bound vulnerable id_event parameter. Successful exploitation of the
|
||
vulnerability results in dbms & application compromise. Exploitation requires no user interaction & without privileged user account.
|
||
|
||
Vulnerable File(s):
|
||
[+] events.php
|
||
|
||
Vulnerable Module(s):
|
||
[+] edit_event
|
||
|
||
Vulnerable Parameter(s):
|
||
[+] id_event
|
||
|
||
|
||
1.2
|
||
Multiple persistent input validation vulnerabilities are detected in the PG Dating Pro v1.0 CMS, turnkey PHP dating software to start internet dating service.
|
||
The bugs allow remote attackers to implement/inject own malicious script code on the application side (persistent). The persistent vulnerabilities are located
|
||
in the shoutbox, edit questions modules with the bound vulnerable message and title. Successful exploitation of the vulnerability can lead to session hijacking
|
||
(manager/admin) or stable (persistent) context manipulation. Exploitation requires low user inter action & privileged web application user account.
|
||
|
||
Vulnerable Module(s):
|
||
[+] Shoutbox
|
||
[+] admin -> Questions & Answers
|
||
|
||
|
||
Vulnerable Parameter(s):
|
||
[+] the message we write in the shout box
|
||
[+] title
|
||
|
||
|
||
Proof of Concept:
|
||
=================
|
||
1.1
|
||
The SQL injection vulnerability can be exploited by remote attackers without user inter action. For demonstration or reproduce ...
|
||
|
||
PoC:
|
||
<html><head><body>
|
||
<title>Proof of Concept: PG Dating Pro v1.0 CMS - Remote SQL Injection Vulnerability</title>
|
||
1<iframe src=http://datingpro.127.0.0.1:5723/dating/events.php?sel=edit_event&id_event=5
|
||
+union+Select+1,2,3,4,5,6,7,8,9,10,11,version%28%29,13,14,15,16,17,18--%20- width="1000" height="800">
|
||
<br>
|
||
2<iframe src=http://datingpro.127.0.0.1:5723/dating/events.php?sel=edit_event&id_event=5
|
||
+union+Select+1,2,3,4,5,6,7,8,9,10,11,()database%28%29,13,14,15,16,17,18--%20- width="1000" height="800">
|
||
</body></head><html>
|
||
|
||
|
||
1.2
|
||
The persistent input validation vulnerabilities can be exploited by remote attackers with low or medium required user inter action
|
||
& low privileged user account. For demonstration or reproduce ...
|
||
|
||
1.2.1
|
||
The attacker can post a message in the shoutbox with injecting a malicious code i.e.,
|
||
>"<iframe src=http://www.vulnerability-lab.com onload=alert("VL")</iframe>
|
||
When the admin or any user view anypage where the shoutbox is displayed the code gets executed.
|
||
|
||
1.2.2
|
||
If an attacker has admin rights he can inject all users by posting a question and editing it is title to have a malicious code,
|
||
such as >"<iframe src=http://www.vulnerability-lab.com onload=alert("VL")</iframe>
|
||
|
||
|
||
Risk:
|
||
=====
|
||
1.1
|
||
The security risk of the remote SQL Injection vulnerability is estimated as critical.
|
||
|
||
1.2
|
||
The security risk of the persistent input validation vulnerabilities are estimated as medium(+).
|
||
|
||
|
||
Credits:
|
||
========
|
||
Vulnerability Laboratory [Research Team] - Ibrahim El-Sayed (the_storm) [storm@vulnerability-lab.com] [iel-sayed.blogspot.com]
|
||
|
||
|
||
Disclaimer:
|
||
===========
|
||
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties,
|
||
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
|
||
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business
|
||
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some
|
||
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation
|
||
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases
|
||
or trade with fraud/stolen material.
|
||
|
||
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.vulnerability-lab.com/register
|
||
Contact: admin@vulnerability-lab.com - support@vulnerability-lab.com - research@vulnerability-lab.com
|
||
Section: video.vulnerability-lab.com - forum.vulnerability-lab.com - news.vulnerability-lab.com
|
||
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
|
||
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
|
||
|
||
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.
|
||
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other
|
||
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and
|
||
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed),
|
||
modify, use or edit our material contact (admin@vulnerability-lab.com or support@vulnerability-lab.com) to get a permission.
|
||
|
||
Copyright © 2012 | Vulnerability Laboratory
|
||
|
||
|
||
|
||
--
|
||
VULNERABILITY RESEARCH LABORATORY
|
||
LABORATORY RESEARCH TEAM
|
||
CONTACT: research@vulnerability-lab.com |