bugtraq - [Bkis-01-2010] Multiple Vulnerabilities in BigAce

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Sun, 23 May 2010 13:10:08 +0700
From: "Bkis" <minhbq@...v.com.vn>
To: <bugtraq@...urityfocus.com>,
	<full-disclosure-request@...ts.grok.org.uk>
Subject: [Bkis-01-2010] Multiple Vulnerabilities in BigAce - Bkis

Multiple Vulnerabilities in BigAce

1. General Information

BigAce is a free content management software (CMS) written in PHP, and is
available at http://www.bigace.de. In April 2010, Bkis Security discovered
an XSS and CSRF vulnerability in BigAce 2.7.1. Taking advantage of this
vulnerability, hacker is able to insert pieces of code into the path's
link to execute in users' browser, leading to the loss of cookies and
session. Hacker can also trick users into manipulating some of the
system's functions without users' awareness.

Bkis has informed the software developer team, and they have patched the
vulnerability in the latest software version - BigAce 2.7.2.

Details: http://security.bkis.com/multiple-vulnerabilities-in-bigace-5/
SVRT Advisory: Bkis-01-2010
Initial vendor notification: 04/26/2010
Release Date: 05/22/2010
Update Date: 05/22/2010
Discovered by: Truong Thao Nguyen
Attack Type: XSS, CSRF
Security Rating: High
Impact: Code Execution
Affected Software: BigAce (version <= 2.7.1)

2. Technical Description

The XSS vulnerability of the software was found in the following modules:
- Create category 
- Create Style sheet
- Create Template
- Edit template
- Create Group
- New permission
- Create new configuration
- Comunties

Because the input variants of this function are not carefully checked and
filtered, hacker is able to insert pieces of code into the path's link.
When users sign in and click this link, the malicious code (JavaScript)
will be executed, and users may lose their cookies, session, etc. 

The CSRF vulnerability of the software was found in the following modules:
- Delete category
- Delete style sheet
- Delete template
- Delete layout
- Delete group
- Active Permission
- Active Modules

Because a task performance process is not authenticated, users can be
tricked into manipulating a task without awareness. Thus, hacker is able
to perform his malicious tricks via a legitimate user.

3. Solution
Bkis recommends all organizations and individuals who are using BigAce to
immediately update the latest software version. 
Download: http://www.bigace.de/BIGACE-2.7.2.html

4. About Bkis
Bkis is Vietnamese leading Company in researching, deploying network
security software and solutions.
Official website: http://www.bkis.com
Blog: http://blog.bkis.com and http://security.bkis.com