101 lines
No EOL
3.1 KiB
Text
101 lines
No EOL
3.1 KiB
Text
Inshell Security Advisory
|
|
http://www.inshell.net
|
|
|
|
|
|
1. ADVISORY INFORMATION
|
|
-----------------------
|
|
Product: Aoop CMS
|
|
Vendor URL: www.annonyme.de
|
|
Type: Cross-site Scripting [CWE-79], SQL-Injection [CWE-89]
|
|
Date found: 2012-04-07
|
|
Date published: 2012-08-24
|
|
CVSSv2 Score: 7,5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) (highest)
|
|
CVE: -
|
|
|
|
|
|
2. CREDITS
|
|
----------
|
|
The vulnerabilities were discovered and researched by Julien Ahrens from
|
|
Inshell Security.
|
|
|
|
|
|
3. VERSIONS AFFECTED
|
|
--------------------
|
|
Aoop CMS v0.3.6, older versions may be affected too.
|
|
|
|
|
|
4. VULNERABILITY DESCRIPTION
|
|
----------------------------
|
|
Aoop CMS v0.3.6 is affected by multiple SQL-Injection and Cross-Site
|
|
Scripting vulnerabilites.
|
|
|
|
|
|
## SQL-Injection Vulnerabilities ##
|
|
|
|
Pre-Auth:
|
|
http://localhost/index.php?print=download&page=Photos&sub=loadAndShowPhoto&picId=[SQLi]
|
|
|
|
Post-Auth:
|
|
http://localhost/index.php?page=users&sub=readMessage&msgId=[SQLi]
|
|
http://localhost/index.php?page=users&sub=newMessage&messageId=[SQLi]
|
|
http://localhost/index.php?page=users&sub=deleteMessage&messageId=[SQLi]
|
|
http://localhost/index.php?page=EProjects&sub=editRFC&rfcId=[SQLi]&projectId=18
|
|
|
|
Due to improper input - validation of these GET parameters, an attacker
|
|
could inject own arbitrary SQL statements without or with required
|
|
authentication. Successful exploitation of these vulnerabilities could
|
|
result in a complete database / web-application compromise or data theft.
|
|
|
|
|
|
## Cross-Site Scripting Vulnerabilities ##
|
|
|
|
Non-Persistent (GET):
|
|
http://localhost/index.php?page=Photos&sub=search&pattern="><script>alert(String.fromCharCode(88,83,83))</script>
|
|
|
|
Non-Persistent (POST):
|
|
http://localhost/index.php?page=Photos&sub=search (Field:
|
|
"Pattern",payload="><script>alert(1)</script>)
|
|
|
|
Due to improper input - validation of these GET/POST parameters, an
|
|
attacker could temporarily inject arbitrary code using required user
|
|
interaction into the context of the website/current browser session.
|
|
Successful exploitation of these vulnerabilities allows for example
|
|
session hijacking or client side context manipulation.
|
|
|
|
|
|
Persistent:
|
|
http://localhost/index.php?page=users&sub=extendUserProfile (Field:
|
|
"profileItemName", "profileItemValue">
|
|
http://localhost/index.php?page=EProjects&sub=viewProject&projectId=18
|
|
(Field: "name","official_link")
|
|
http://localhost/index.php?page=Photos&sub=uploadPic (Field: "Title")
|
|
|
|
Due to improper input - validation of these input fields, an attacker
|
|
could permanently inject arbitrary code using an own registered
|
|
user-account into the context of the website. Successful exploitation of
|
|
these vulnerabilities allows for example session hijacking or server
|
|
side context manipulation.
|
|
|
|
|
|
5. PROOF-OF-CONCEPT (CODE / Exploit)
|
|
------------------------------------
|
|
For further screenshots and/or PoCs visit:
|
|
http://security.inshell.net/advisory/23
|
|
|
|
|
|
6. SOLUTION
|
|
-----------
|
|
Update to v0.4 RC3
|
|
|
|
|
|
7. REPORT TIMELINE
|
|
------------------
|
|
2012-04-07: Initial notification sent to vendor
|
|
2012-04-08: Vendor Response / Feedback
|
|
2012-07-29: Vendor releases v0.4 RC3 which fixes the vulnerabilities
|
|
2012-08-24: Coordinated public release of advisory
|
|
|
|
|
|
8. REFERENCES
|
|
-------------
|
|
http://security.inshell.net |