19000e5589
4 new exploits MkPortal 1.1.1 reviews / Gallery modules - SQL Injection MKPortal 1.1.1 reviews / Gallery modules - SQL Injection Joomla! Component GigCalendar 1.0 - SQL Injection Joomla! Component gigCalendar 1.0 - SQL Injection Joomla! Component RD-Autos 1.5.5 - 'id' SQL Injection mkportal 1.2.1 - Multiple Vulnerabilities Blue Eye CMS 1.0.0 - (clanek) Blind SQL Injection Free Bible Search PHP Script - 'readbible.php' SQL Injection Joomla! Component RD-Autos 1.5.5 - SQL Injection MKPortal 1.2.1 - Multiple Vulnerabilities Blue Eye CMS 1.0.0 - 'clanek' Parameter Blind SQL Injection Free Bible Search PHP Script - SQL Injection Simple PHP NewsLetter 1.5 - (olang) Local File Inclusion Simple PHP NewsLetter 1.5 - Local File Inclusion Joomla! Component Gigcal 1.x - 'id' SQL Injection Joomla! Component Gigcal 1.x - 'id' Parameter SQL Injection SCMS 1 - 'index.php p' Local File Inclusion SCMS 1 - Local File Inclusion Max.Blog 1.0.6 - (show_post.php) SQL Injection Max.Blog 1.0.6 - 'show_post.php' SQL Injection Max.Blog 1.0.6 - (submit_post.php) SQL Injection Max.Blog 1.0.6 - (offline_auth.php) Offline Authentication Bypass Max.Blog 1.0.6 - 'submit_post.php' SQL Injection Max.Blog 1.0.6 - 'offline_auth.php' Offline Authentication Bypass Joomla! Component com_simplefaq - 'catid' Blind SQL Injection Joomla! Component com_simplefaq - 'catid' Parameter Blind SQL Injection dirLIST - Multiple Local File Inclusion / Arbitrary File Upload Vulnerabilities dirLIST 0.3.0 - Local File Inclusion dirLIST 0.3.0 - Arbitrary File Upload BoZoN 2.4 - Remote Code Execution Check Box 2016 Q2 Survey - Multiple Vulnerabilities Openexpert 0.5.17 - SQL Injection
55 lines
2.6 KiB
Text
Executable file
55 lines
2.6 KiB
Text
Executable file
# Exploit Title: Check Box 2016 Q2 Survey Multiple Vulnerabilities
|
|
# Exploit Author: Fady Mohamed Osman (@fady_osman)
|
|
# Exploit-db : http://www.exploit-db.com/author/?a=2986
|
|
# Youtube : https://www.youtube.com/user/cutehack3r
|
|
# Date: Jan 17, 2017
|
|
# Vendor Homepage: https://www.checkbox.com/
|
|
# Software Link: https://www.checkbox.com/free-checkbox-trial/
|
|
# Version: Check Box 2016 Q2,Check Box 2016 Q4 - Fixed in Checkbox Survey,
|
|
Inc. v6.7
|
|
# Tested on: Check Box 2016 Q2 Trial on windows Server 2012.
|
|
# Description : Checkbox is a survey application deployed by a number of
|
|
highly profiled companies and government entities like Microsoft, AT&T,
|
|
Vodafone, Deloitte, MTV, Virgin, U.S. State Department, U.S. Secret
|
|
Service, U.S. Necular Regulatory Comission, UNAIDS, State Of California
|
|
and more!!
|
|
|
|
For a full list of their clients please visit:
|
|
https://www.checkbox.com/clients/
|
|
|
|
1- Directory traversal vulnerability : For example to download the
|
|
web.config file we can send a request as the following:
|
|
http://www.example.com/Checkbox/Upload.ashx?f=..\..\web.config&n=web.config
|
|
|
|
2- Direct Object Reference :
|
|
attachments to surveys can be accessed directly without login as the
|
|
following:
|
|
https://www.victim.com/Checkbox/ViewContent.aspx?contentId=5001
|
|
I created a script that can bruteforce the numbers to find ID's that will
|
|
download the attachment and you can easily write one on your own ;).
|
|
|
|
3- Open redirection in login page for example:
|
|
https://www.victim.com/Checkbox/Login.aspx?ReturnUrl=http://www.google.com
|
|
|
|
If you can't see why an open redirection is a problem in login page please
|
|
visit the following page:
|
|
https://www.asp.net/mvc/overview/security/preventing-
|
|
open-redirection-attacks
|
|
|
|
|
|
Timeline:
|
|
December 2016 - Discovered the vulnerability during Pen. Test conducted by
|
|
ZINAD IT for one of our clients.
|
|
Jan 12,2017 - Reported to vendor.
|
|
Jan 15,2017 - Sent a kind reminder to the vendor.
|
|
Jan 16,2017 - First Vendor Response said they will only consider directory
|
|
traversal as a vulnerability and that a fix will be sent in the next day.
|
|
Jan 16,2017 - Replied to explain why DOR and Open Redirect is a problem.
|
|
Jan 17,2017 - Patch Release Fixed the Directory Traversal.
|
|
Jan 17,2017 - Sent another email to confirm if DOR and open redirect wont
|
|
be fixed.
|
|
Jan 17,2017 - Open redirection confirmed to be fixed in the same patch
|
|
released before for DOR the vendor said they didn't believe that's a
|
|
security concern and that they have added a warning to let users know that
|
|
their attachments will be available to anyone with access to that survey page !!
|
|
|