full-disclosure - [Bkis-13-2009] e107 Multiple Vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Mon, 23 Nov 2009 12:19:44 +0700
From: Bkis <svrt@...v.com.vn>
To: bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk
Subject: [Bkis-13-2009] e107 Multiple Vulnerabilities

[Bkis-13-2009] e107 Multiple Vulnerabilities

1. General Information
e107 is a free content management system (CMS) written in PHP language 
and is available at http://e107.org/news.php . In October 2009, Bkis 
Security discovered a number of XSS and Blind SQL Injection 
vulnerabilities on this system. Taking advantage of these holes, hackers 
can insert arbitrary malicious codes onto users' browsers, then steal 
private information or carry out requests to the website to gain 
complete control of the website's database.

Details: http://blog.bkis.com/e107-multiple-vulnerabilities/
SVRT Advisory: Bkis-13-2009
Initial vendor notification: 10/28/09
Release Date: 11/23/09
Update Date: 11/23/09
Discovered by: Do Hoang Bach, Bkis
Attack Type: XSS, SQL Injection
Security Rating: High
Impact: Code Execution
Affected Software: E107 (ver <= 0.7.16)

2. Technical details
The found XSS holes reside in the following modules:
- submitnews.php
- usersettings.php.
- e107_admin/newpost.php.
- e107_admin/banlist.php.
- e107_admin/banner.php.
- e107_admin/cpage.php
- e107_admin/download.php.
- e107_admin/users_extended.php.
- e107_admin/frontpage.php.
- e107_admin/links.php.
- e107_admin/mailout.php.

To be specific, the flaws on these modules are results of inadequate 
check of input variables, allowing hackers to insert scripts onto the 
links before sending them to e107's users. When users log in to e107 and 
click on these links, the malicious codes will be executed on their 
browsers. By this way, hackers  can harvest cookies, sessions, etc on 
the infected machines and, therefore, are able to steal secret 
information of users.

The Blind SQL Injection hole lies in Search function of the website. 
Exploiting this hole, hackers can carry out any requests to the website 
and get the complete control of the its database.  

3. Solution
As these are dangerous vulnerabilities, Bkis has notified e107's 
developer of the problem. Besides, we recommend that individuals, 
organizations using e107 be cautious of links from unclear origins, and 
regularly check for  patch on e107's website.

--------------
http://blog.bkis.com

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/