full-disclosure - BF, XSS, IAA and CSRF vulnerabilities in poMMo

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <004001ccb9e6$79bd2f80$9b7a6fd5@ml>
Date: Wed, 14 Dec 2011 00:27:04 +0200
From: "MustLive" <mustlive@...security.com.ua>
To: <submissions@...ketstormsecurity.org>, <full-disclosure@...ts.grok.org.uk>
Subject: BF, XSS, IAA and CSRF vulnerabilities in poMMo

Hello list!

I want to warn you about new multiple security vulnerabilities in poMMo.

These are Brute Force, Cross-Site Scripting, Insufficient Anti-automation
and Cross-Site Request Forgery vulnerabilities.

-------------------------
Affected products:
-------------------------

Vulnerable are all versions of poMMo (poMMo Aardvark PR16.1 and previous
versions).

----------
Details:
----------

Brute Force (WASC-11):

http://site/pommo/index.php

XSS (WASC-08):

http://site/pommo/index.php?referer=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E

Insufficient Anti-automation (WASC-21):

In function "Forgot your password" at page http://site/pommo/index.php there
is no reliable protection against automated requests - the text captcha is
using (which can be easily bypassed with using appropriate algorithm, or
it's possible to use value of correct answer in parameter realdeal, which is
making by JS-code). And also there is leakage of admin's email.

CSRF / IAA (WASC-09):

Or it's possible to send request directly to pending.php:

http://site/pommo/user/pending.php?input=a:2:{s:7:%22adminID%22;b:1;s:5:%22Email%22;s:7:%221@...om%22;}

At this page there is no protection against automated requests and CSRF
(captcha). Which allows to automatically send confirmation letters to email
of admin. And also to use this vulnerability for XSS attack
(http://websecurity.com.ua/5315/), which I've informed about earlier.

------------
Timeline:
------------

2011.10.29 - announced at my site.
2011.10.30 - informed developers.
2011.12.13 - disclosed at my site.

I mentioned about these vulnerabilities at my site:
http://websecurity.com.ua/5472/

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/