Message-ID: <21a401caf999$51d2c340$f57849c0$@bkav.com.vn>
Date: Sat, 22 May 2010 17:27:02 +0700
From: "Bkis" <minhbq@...v.com.vn>
To: <bugtraq@...urityfocus.com>,
	<full-disclosure-request@...ts.grok.org.uk>
Subject: [Bkis-01-2010] Multiple Vulnerabilities in BigAce - Bkis

[Bkis-01-2010] Multiple Vulnerabilities in BigAce
 
1. General Information
 
BigAce is a free content management software (CMS) written in PHP, and is available at http://www.bigace.de. In April 2010, Bkis Security discovered an XSS and CSRF vulnerability in BigAce 2.7.1. Taking advantage of this vulnerability, hacker is able to insert pieces of code into the path’s link to execute in users’ browser, leading to the loss of cookies and session. Hacker can also trick users into manipulating some of the system’s functions without users’ awareness.
 
Bkis has informed the software developer team, and they have patched the vulnerability in the latest software version -  BigAce 2.7.2.
 
Details: http://security.bkis.com/multiple-vulnerabilities-in-bigace-5/
SVRT Advisory: Bkis-01-2010
Initial vendor notification: 04/26/2010
Release Date: 05/22/2010
Update Date: 05/22/2010
Discovered by: Truong Thao Nguyen
Attack Type: XSS, CSRF
Security Rating: High
Impact: Code Execution
Affected Software: BigAce (version <= 2.7.1)
 
2. Technical Description
 
The XSS vulnerability of the software was found in the following modules:
- Create category
- Create Style sheet
- Create Template
- Edit template
- Create Group
- New permission
- Create new configuration
- Comunties
 
Because the input variants of this function are not carefully checked and filtered, hacker is able to insert pieces of code into the path’s link. When users sign in and click this link, the malicious code (JavaScript) will be executed, and users may lose their cookies, session, etc. 
 
The CSRF vulnerability of the software was found in the following modules:
- Delete category
- Delete style sheet
- Delete template
- Delete layout
- Delete group
- Active Permission
- Active Modules
 
Because a task performance process is not authenticated, users can be tricked into manipulating a task without awareness. Thus, hacker is able to perform his malicious tricks via a legitimate user.
 
3. Solution
Bkis recommends all organizations and individuals who are using BigAce to immediately update the latest software version. 
Download: http://www.bigace.de/BIGACE-2.7.2.html
 
4. About Bkis
Bkis is Vietnamese leading Company in researching, deploying network security software and solutions.
Official website: http://www.bkis.com
Blog: http://blog.bkis.com and http://security.bkis.com
 

----------------------------------------------------------------
Bui Quang Minh
Manager - Vuln Team - Bkis Security - Bkis

Office : Hitech building - 1A Dai Co Viet, Hanoi Tel : 84 4 8684757 ext. 119 Mobile : 84 98 64 64 517 Email : minhbq@...v.com.vn Website : www.bkav.com.vn Blog : blog.bkis.vn
----------------------------------------------------------------
Do your best, the rest will come !
Hãy làm việc hết mình, những điều tốt đẹp sẽ đến với bạn!

Disclaimer: This e-mail and any files transmitted with it are confidential and may contain privileged information. It is intended solely for the use of the individual to whom it is addressed and others authorized to receive it. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. If you have received this message in error, please notify the sender immediately by reply e-mail and delete completely this e-mail from your system, without reproducing, distributing or retaining copies.

Powered by blists - more mailing lists