lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: 3 May 2005 10:11:27 -0000
From: <>
Subject: Multiple vulnearabilities in e107 cms

Author: Heintz
Advisory origin:
Software bugtracker:

e107 v 0.617
search.php line ~ 142
        echo "<div style='border:0;padding-right:2px;width:auto;height:400px;overflow:auto;'>";

here extract() registeres and overwrites any variables in _POST array - this is worse than
registered globals.

few lines forward:
   $ns -> tablerender(LAN_195." ".$search_info[$key[$a]]['qtype']." : ".LAN_196.": ".$results, 


so we need to POST following variables:

lets look forward

top.php line ~79
sql queries before it has quotes around variable and those cant be braken out, but
in this case there isnt need to send any quotes in variable:

$replies = $sql2 -> db_Select("forum_t", "*", "thread_parent=$thread_id");

though this requires mysql version to support subqueries, to have any use of this.

lets look more:
when downloads are handled/sent by php (this option turned on)

request.php ~87


when theres not "http://" or "ftp://" in file to be downloaded, then 
file is read and sent to user.


downloaded CVS and things are better but not enought,
this advisory continues with CVS version of software.
CVS is subject to change however.

lets start with less dangerous features of software:

e107_files/resetcore.php ~199

if (isset($_POST['reset_core_sub']) && $_POST['mode'] == 1) {
$a_name = preg_replace('/\\W/i', '', $_POST['a_name']);
$a_password = preg_replace('/\\W/i', '', $_POST['a_password']);
if (!$result = mysql_query("SELECT * FROM ".$mySQLprefix."user WHERE user_name='{$a_name}' AND 

user_password='{$a_password}' AND user_perms=0")) {

if reset_core_sub and mode variables are set and sql query syntax is ok,
note i sayd query *syntax* - no data needs to retrieved with query.
then we get cms core configuration as a good info which we are going into.

lets move on

forum_viewforum.php ~196

if($sql -> db_Select("forum_t", "*",  "thread_forum_id='".$forum_id."' AND thread_parent='0' 

ORDER BY thread_s DESC, thread_lastpost DESC, thread_datestamp DESC LIMIT $from, $view")){


lets go on

request.php line ~120

if ($type == "file")
$qry = "
SELECT d.*, dc.download_category_class FROM #download as d
LEFT JOIN #download_category AS dc ON dc.download_category_id = d.download_id
WHERE d.download_id = $id;




will try to redirect your browser to <adminhash>http://
in HTTP Location header.

and on

e107_handlers/upload_handler.php ~38

if ($pref['upload_storagetype'] == "2" && $avatar == FALSE) {
		for($c = 0; $c <= 1; $c++)

with enought knowlege about HTTP it would be possible to
"rewrite" _FILES to load local file to db (not very useful i guess, but read on)

extract() is able to rewrite _SESSION array, this is disasterous because this is
one array that is almost always trusted to contain valid data.
so we can enter admin hash and id to it and we are admin, and this leads to
own php code execution - which makes things real nasty.

slimjim100, fulvioo, Gotisch, KuerbY, legion and Torufoorum.
Special greets go to Waraxe.

Powered by blists - more mailing lists