bugtraq - SQL Injection in Osclass

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 17 Feb 2016 16:16:28 +0100 (CET)
From: High-Tech Bridge Security Research <advisory@...ridge.ch>
To: bugtraq@...urityfocus.com
Subject: SQL Injection in Osclass

Advisory ID: HTB23287
Product: Osclass
Vendor: https://osclass.org/
Vulnerable Version(s): 3.5.9 and probably prior
Tested Version: 3.5.9
Advisory Publication:  December 21, 2015  [without technical details]
Vendor Notification: December 21, 2015 
Vendor Patch: January 25, 2016 
Public Disclosure: February 17, 2016 
Vulnerability Type: SQL Injection [CWE-89]
Risk Level: High 
CVSSv3 Base Score: 7.1 [CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L]
Solution Status: Fixed by Vendor
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ ) 

-----------------------------------------------------------------------------------------------

Advisory Details:

High-Tech Bridge Security Research Lab discovered a high-risk SQL injection vulnerability in Osclass, a popular web-based software for building customized classifieds marketplace. The vulnerability can be exploited to gain access to potentially sensitive information in the application database and even to compromise the entire website.

The vulnerability exists due to insufficient filtration of user-supplied input data passed via the "itemsPerPage" HTTP GET parameter to "/index.php" PHP script. A remote unauthenticated attacker can modify the original SQL query and execute arbitrary SQL commands in application's database.

A simple PoC code below uses a time-based SQL injection technique to demonstrate existence of the vulnerability. The following HTTP request will make page rendering very slow, if MySQL server uses 5th version:

http://[host]/index.php?page=user&action=pub_profile&id=1&itemsPerPage=1%20PROCEDURE%20analyse%28%28select%20extractvalue%28rand%28%29, concat%280x3a, %28IF%28MID%28version%28%29, 1, 1%29%20LIKE%205, %20BENCHMARK%285000000, SHA1%281%29%29, 1%29%29%29%29%29, 1%29

-----------------------------------------------------------------------------------------------

Solution:

Update to Osclass 3.6.0

More Information:
https://blog.osclass.org/2016/01/25/osclass-3-6-0-ready-to-download/

-----------------------------------------------------------------------------------------------

References:

[1] High-Tech Bridge Advisory HTB23287 - https://www.htbridge.com/advisory/HTB23287 - SQL Injection in Osclass
[2] Osclass - https://osclass.org/ - Osclass is a php script that allows you to quickly create and manage your own free classifieds site.
[3] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types.
[4] ImmuniWeb® - https://www.htbridge.com/immuniweb/ - web security platform by High-Tech Bridge for on-demand and continuous web application security, vulnerability management, monitoring and PCI DSS compliance.
[5] Free SSL/TLS Server test - https://www.htbridge.com/ssl/ - check your SSL implementation for PCI DSS and NIST compliance. Supports all types of protocols.

-----------------------------------------------------------------------------------------------

Disclaimer: The information provided in this Advisory is provided "as is" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References.