bugtraq - [KIS-2015-03] Concrete5 <= 5.7.4 (Access.php) SQL Injection Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 11 Jun 2015 21:55:11 +0200
From: Egidio Romano <research@...mainsecurity.com>
To: bugtraq@...urityfocus.com, fulldisclosure@...lists.org
Subject: [KIS-2015-03] Concrete5 <= 5.7.4 (Access.php) SQL Injection Vulnerability

-----------------------------------------------------------
Concrete5 <= 5.7.4 (Access.php) SQL Injection Vulnerability
-----------------------------------------------------------


[-] Software Link:

https://www.concrete5.org/


[-] Affected Versions:

Version 5.7.3.1, 5.7.4, and probably other versions.


[-] Vulnerability Description:

The vulnerable code is located in /concrete/src/Permission/Access/Access.php:

168.	protected function buildAssignmentFilterString($accessType, $filterEntities)
169.	{
170.	    $peIDs = '';
171.	    $filters = array();
172.	    if (count($filterEntities) > 0) {
173.	        foreach ($filterEntities as $ent) {
174.	            $filters[] = $ent->getAccessEntityID();
175.	        }
176.	        $peIDs .= 'and peID in (' . implode($filters, ',') . ')';
177.	    }
178.	    if ($accessType == 0) {
179.	        $accessType = '';
180.	    } else {
181.	        $accessType = ' and accessType = ' . $accessType;
182.	    }

The Access::buildAssignmentFilterString() method uses its $accessType parameter to construct a SQL query
without a proper validation at line 181. This can be exploited to inject and execute arbitrary SQL commands.
Successful exploitation of this vulnerability requires an account with privileges to edit page permissions.


[-] Solution:

Update to version 5.7.4.1 or later.


[-] Disclosure Timeline:

[05/05/2015] - Vulnerability details sent through HackerOne
[12/05/2015] - Vendor said a patch has been committed and will be available in the next version
[12/05/2015] - Version 5.7.4.1 released along with the patch for this vulnerability
[11/06/2015] - Vulnerability publicly disclosed on HackerOne
[11/06/2014] - CVE number requested
[11/06/2014] - Publication of this advisory


[-] CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org) has not assigned a name to this vulnerability yet.


[-] Credits:

Vulnerability discovered by Egidio Romano of Minded Security.


[-] Original Advisory:

http://karmainsecurity.com/KIS-2015-03


[-] Other References:

https://hackerone.com/reports/59664