bugtraq - Chipmailer <= 1.09 Multiple Vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: 13 Jun 2006 19:46:25 -0000
From: tamriel@....net
To: bugtraq@...urityfocus.com
Subject: Chipmailer <= 1.09 Multiple Vulnerabilities


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

     Advisory: Chipmailer <= 1.09 Multiple Vulnerabilities
 Release Date: 2006/06/13
Last Modified: 2006/06/13
       Author: Tamriel [tamriel at gmx dot net]
  Application: Chipmailer <= 1.09
         Risk: Medium
Vendor Status: no patch available
  Vendor Site: chipmailer.de


Overview:

   Quote from http://chipmailer.de

   "Der Chipmailer ist ein Paidmail Script der neuesten Generation, 
   welches mit Attraktiven Vorteilen winkt. Dieses Script hat sehr 
   viele Funktionen für Benutzer, Sponsoren sowie für Administratoren."


Details:

   1) Cross Site Scripting Vulnerabilities in main.php
      (arround line 300-310)

      ...

      $sitename = data("sitename");
      $name = $_POST['name'];
      $betreff = $_POST['betreff'];
      $betreff = "Anfrage bei ".$sitename." über ".$betreff."";
      $mail = $_POST['mail'];
      $adminmail = data("adminmail");
      $text = $_POST['text'];

      mail($adminmail, $betreff, $text, "From: $name <$mail>");

      ...

      Nothing will be checked so an attacker can send the
      site administrator some shit.

      In the complete script you can found this vulnerabilities so i
      mention only one example here.

   2) SQL Injection Vulnerability in main.php
      (arround line 335)

      ...

      $anfang = $_GET['anfang'];
      $connect = mysql_query("SELECT head, autor, date, text FROM news 
      order by id desc LIMIT $anfang, 10");

      ...

   3) Public phpinfo() in php.php
      (arround line 2)

      <?
      phpinfo();
      ?>

      In the php.php file, included in the install files from this script 
      is just a phpinfo() command used, so attackers can easy collect
      information about their victims.

   4) SQL Injection Vulnerability in main.php
      (arround line 30-140)
      
      ...

      $name = $_POST['name'];
      $pass = md5($_POST['pass']);
      $passwdh = md5($_POST['passwdh']);
      $mail = $_POST['mail'];

      $anrede = $_POST['anrede'];
      $vorname = $_POST['vorname'];
      $nachname = $_POST['nachname'];

      $gebtag = $_POST['gebtag'];
      $gebmonat = $_POST['gebmonat'];
      $gebjahr = $_POST['gebjahr'];

      ...
      
      mysql_query("INSERT INTO user ( name, pass, mail, ip, status, register, anrede, vorname, nachname,
      strasse, hausnr, plz, stadt, land, geb, `int1`, `int2`, `int3`, `int4`, `int5`, `int6`, `int7`,
      `int8`, `int9`, `int10`, `int11`, `int12`, `int13`, `int14`, `int15`, `int16`, `int17`,
      `int18`, `int19`, `int20`, `int21`, newsletter, werber, paidmails, bespaidmails ) VALUES
      	 ( '$name', '$pass', '$mail', '$ip', '2', '$date', '$anrede', '$vorname', '$nachname', '$strasse', '$hausnr',
      '$plz', '$stadt', '$land', '$geb', '$int1', '$int2', '$int3', '$int4', '$int5', '$int6', '$int7',
      '$int8', '$int9', '$int10', '$int11', '$int12', '$int13', '$int14', '$int15', '$int16', '$int17',
      '$int18', '$int19', '$int20', '$int21', '$newsletter', '$werber', '0', '0' )");

      ...

      If magic_quotes_gpc is off, then you can directly inject malicious SQL code.

      The same in (for example):

          line 1366-1369
          line 1519-1520
          line 1768-1769
          ...


Proof of Concept:

      index.php?area=news&anfang=0/*


Note:

      It is strongly recommended to update your script by yourself.
      Check out some other insecure handlings, like the logout handling with not overwrites 
      the existence cookie.
 
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3

iD8DBQFEjyQrqBhP+Twks7oRArnAAKCS99/tPofih3VT5r7rEPS3wcq5oQCfckFN
4uKl2tTrA802OsBlya53Vj8=
=d7Dx
-----END PGP SIGNATURE-----