HTB23186: MijoSearch Joomla Extension - XSS and Full Path Disclosure

High-Tech Bridge Security Research Lab discovered 2 vulnerabilities in MijoSearch Joomla Extension version 2.0.1, which can be exploited to gain access to potentially sensitive data and perform Cross-Site Scripting (XSS) attacks against users of vulnerable application.

Cross-site Scripting vulnerability in MijoSearch exists due to insufficient sanitisation of user-supplied data appended to "/component/mijosearch/search" URL. A remote attacker can trick a logged-in user to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.

Information Exposure Through Externally-generated Error Message vulnerability in MijoSearch exists due to improper implementation of error handling mechanisms in "/component/mijosearch/search" URL. A remote attacker can send a specially crafted HTTP GET request to the vulnerable web application and gain knowledge of full installation path of the application.

Read full details at High-Tech Bridge Advisory HTB23186: Multiple Vulnerabilities in MijoSearch.

HTB23183: Bitrix Site Manager - User Identity Spoofing - CWE-345

High-Tech Bridge Security Research Lab discovered vulnerability in Bitrix Site Manager version 12.5.13, which can be exploited to spoof user's identity and read, modify or delete pre-ordered items in customer's basket.

User Identity Spoofing vulnerability (CWE-345) in Bitrix Site Manager version 12.5.13 exists due to insufficient verification of supplied data authenticity when displaying pre-order items in customer's basket in the e-Store Module of Bitrix Site Manager. A remote unauthenticated user can change "BITRIX_SM_SALE_UID" cookie, view another user's basket and perform certain actions, e.g. add or delete items in the basket. The e-Store Module must be installed on the system and knowledge of a valid "BITRIX_SM_SALE_UID" cookie is required. This value can be easily guessed using simple brute-force techniques, since the application increases its value by 1 with every new customer.

Below are exploitation instructions for this vulnerability. You will need to open two different browsers with plugins that allow cookie management.

1. Open your first browser
2. Visit the following URL http://[host]/buy/cms.php and add items to the basket.
3. You will be redirected to the following URL: http://[host]/personal/cart.php
4. Record your "BITRIX_SM_SALE_UID" cookie value.
5. Open your second browser and navigate to the following URL: http://[host]/personal/cart.php
6. Change the value of your "BITRIX_SM_SALE_UID" cookie to the one you recorded before and delete all other cookies.
7. Refresh the page http://[host]/personal/cart.php. You will see pre-ordered items of another user.

Solution: Update "sale" module to version 14.0.1

More Information: www.bitrixsoft.com/products/cms/versions.php?module=sale

HTB23185: SQL Injection in InstantCMS

High-Tech Bridge Security Research Lab discovered blind SQL injection vulnerability in InstantCMS version 1.10.3, which can be exploited to perform SQL Injection attacks, alter SQL requests and compromise vulnerable application.

SQL Injection vulnerability in InstantCMS exists due to insufficient filtration of "orderby" HTTP POST parameter passed to "/catalog/[id]" URL. A remote unauthenticated attacker can execute arbitrary SQL commands in application's database. Simple exploit code in advisory uses blind SQL injection exploitation technique.

Solution: Apply patch for InstantCMS 1.10.3
InstantCMS 1.10.3 downloaded after November 21, 2013 is patched [without version/release modification] and is not vulnerable for this vulnerability.

HTB23184: Cross-Site Scripting (XSS) in Jamroom

Jamroom, social media platform, version 5.0.2 is vulnerable to perform cross-site scripting (XSS) attacks. Details are disclosed by High-Tech Bridge Security Research Lab.

The XSS vulnerability exists due to insufficient sanitisation of user-supplied data in "search_string" HTTP POST parameter passed to URLs like "/search/results/all/1/4". A remote attacker can trick a logged-in user to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.

The exploitation example below uses the JavaScript "alert()" function to display "immuniweb" word:
<form action="http://[host]/search/results/all/1/4" method="post" name="main">
<input type="hidden" name="search_string" value='" onmouseover="javascript:alert("immuniweb");'>
<input type="submit" id="btn">
</form>


Solution: Update Jamroom Search module to version 1.1.1.

HTB23179: Claroline 1.11.8 multiple cross-site scripting (XSS)

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in Claroline version 1.11.8, which can be exploited to perform Cross-Site Scripting (XSS) attacks against vulnerable web application visitors and administrators.

Cross-Site Scripting (XSS) in Claroline: CVE-2013-6267
1.1 The vulnerability exists due to insufficient sanitisation of user-supplied data in "box" HTTP GET parameter passed to "/claroline/messaging/messagebox.php" script. A remote attacker can trick a logged-in user to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website. The exploitation example below uses the "alert()" JavaScript function to display "ImmuniWeb" word:
http://[host]/claroline/messaging/messagebox.php?box=%22%3E%3Cscript%3Ealert%28%27ImmuniWeb%27%29;%3C /script%3E

1.2 The vulnerability exists due to insufficient filtration of user-supplied data in "cidToEdit" HTTP GET parameter passed to "/claroline/admin/adminregisteruser.php" script. A remote attacker can trick a logged-in administrator to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website. The exploitation example below uses the "alert()" JavaScript function to display "immuniweb" word:
http://[host]/claroline/admin/adminregisteruser.php?cidToEdit=94102_001%22%3E%3Cscript%3Ealert%28%27 imuniweb%27%29;%3C/script%3E

1.3 The vulnerability exists due to insufficient sanitisation of user-supplied data in "cidToEdit" HTTP GET parameter passed to "/claroline/admin/admin_user_course_settings.php" script. A remote attacker can trick a logged-in administrator to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website. The exploitation example below uses the "alert()" JavaScript function to display "immuniweb" word:
http://[host]/claroline/admin/admin_user_course_settings.php?ccfrom=culist&cidToEdit=94102%22%3E%3Cs cript%3Ealert%28%27imuniweb%27%29;%3C/script%3E&uidToEdit=1

1.4 The vulnerability exists due to insufficient sanitisation of user-supplied data in "module_id" HTTP GET parameter passed to "/claroline/admin/module/module.php" script. A remote attacker can trick a logged-in administrator to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website. The exploitation example below uses the "alert()" JavaScript function to display "immuniweb" word:
http://[host]/claroline/admin/module/module.php?module_id=4%22%3E%3Cscript%3Ealert%28%27imuniweb%27% 29;%3C/script%3E

1.5 The vulnerability exists due to insufficient sanitisation of user-supplied data in "offset" HTTP GET parameter passed to "/claroline/admin/right/profile_list.php" script. A remote attacker can trick a logged-in administrator to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website. The exploitation example below uses the "alert()" JavaScript function to display "immuniweb" word:
http://[host]/claroline/admin/right/profile_list.php?cmd=exLock&offset=0%22%3E%3Cscript%3Ealert%28%2 7imuniweb%27%29;%3C/script%3E

Solution: Update to Claroline 1.11.9

References:

1. High-Tech Bridge Advisory HTB23179 - Multiple Cross-Site Scripting (XSS) in Claroline.
2. Claroline - Claroline is an Open Source software to easily deploy a platform for learning and collaboration online.

HTB23181: SQL Injection in Dokeos

High-Tech Bridge Security Research Lab discovered vulnerability in Dokeos version 2.2RC, which can be exploited to perform SQL Injection attacks.

SQL Injection in Dokeos 2.2RC: CVE-2013-6341
The vulnerability exists due to insufficient validation of "language" HTTP GET parameter passed to "/index.php" script. A remote unauthenticated attacker can execute arbitrary SQL commands in application's database and gain complete control over the vulnerable web application.

The following exploitation example displays version of MySQL server:

http://[host]/index.php?language=0%27%20UNION%20SELECT%201,2,3,4,version%28%29,6,7,8%20--%202

Solution: Unofficial patch was developed by High-Tech Bridge Security Research Lab and is available here: https://www.htbridge.com/advisory/HTB23181-patch.zip

References:

1. High-Tech Bridge Advisory HTB23181 - SQL Injection in Dokeos.
2. Dokeos - the flexible, enterprise-ready e-learning software.

HTB23182: Chamilo LMS SQL injection SQLi

Chamilo LMS version 1.9.6 is vulnerable to perform SQL injection attacks, discovered by High-Tech Bridge Security Research Lab.

Chamilo LMS - Chamilo aims at bringing you the best e-learning and collaboration platform in the open source world.

SQL Injection vulnerability in Chamilo LMS exists due to insufficient validation of "password0" HTTP POST parameter passed to "/main/auth/profile.php" script. A remote authenticated attacker can execute arbitrary SQL commands in application's database. Exploitation example in advisory HTB23182 - SQL Injection in Chamilo LMS displays version of MySQL server. Successful exploitation of this vulnerability requires that the application is configured during installation not to encrypt users' passwords ("Encryption method" option is set to "none").

Solution: Edit the source code and apply changes according to vendor's instructions.

HTB23180: Tweet Blender 4.0.1 Wordpress Plugin cross-site scripting XSS

Tweet Blender Wordpress Plugin version 4.0.1 is vulnerable to perform cross-site scripting (XSS) attacks, discovered (HTB23180) by High-Tech Bridge Security Research Lab.

Tweet Blender Wordpress Plugin provides several Twitter widgets: show your own tweets, show tweets relevant to post's tags, show tweets for Twitter lists, show tweets for hasht.

Cross-Site Scripting (XSS) vulnerability in Tweet Blender exists due to insufficient sanitisation of user-supplied data in "tb_tab_index" HTTP POST parameter passed to "/wp-admin/options-general.php" script. A remote attacker can trick a logged-in administrator to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website. The exploitation example below uses the "alert()" JavaScript function to display "ImmuniWeb" word:

<form action="http://[host]/wp-admin/options-general.php?page=tweet-blender/admin-page.php" method="post" name="main">
<input type="hidden" name="tb_tab_index" value='</script><script>alert("ImmuniWeb");</script>'>
<input type="submit" id="btn">
</form>


This vulnerability patched in Tweet Blender version 4.0.2

HTB23178: Zikula Application Framework cross-site scripting (XSS)

Zikula Application Framework version 1.3.5 build 20 and probably prior is vulnerable to perform XSS (cross-site scripting) attacks. Details of vulnerability are disclosed this week by High-Tech Bridge Security Research Lab.

Cross-site scripting (XSS) vulnerability in Zikula Application Framework exists due to insufficient sanitisation of user-supplied data in "returnpage" HTTP GET parameter passed to "/index.php" script. A remote attacker can trick a logged-in user to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.

Solution: Update to Zikula 1.3.6 build 19

Additional details available on researcher's page and on zikula.org.

HTB23177: SQL Injection in appRain

High-Tech Bridge Security Research Lab discovered vulnerability in appRain, which can be exploited to perform SQL Injection attacks.

Blind SQL Injection vulnerability in appRain is caused by insufficient validation of user-supplied data appended to "/blog-by-cat/" URL. Remote attacker can execute arbitrary SQL commands to read, modify or delete information in application's database.

The following exploitation example will display all posts from category 1, if the MySQL Server version is 5.x, otherwise no posts will be displayed:
http://[host]/blog-by-cat/1%20and%20substring(version(),1,1)=5/

Solution: Vendor did not reply to notifications, unofficial patch was developed by High-Tech Bridge Security Research Lab and is available here: https://www.htbridge.com/advisory/HTB23177-patch.zip

Source: High-Tech Bridge Advisory HTB23177 - SQL Injection in appRain.

Yahoo launches $15,000 bug bounty program

Yahoo launches $15,000 bug bounty after $12.50 company voucher debacle
Web portal Yahoo launched a bug bounty programme on Friday following the scandal that unravelled last month, which saw a security firm rewarded with a $12.50 Yahoo Company Store voucher for uncovering a security flaw.

In what is good news for security researchers, Yahoo said that the bounty programme will now pay up to $15,000 to ethical hackers who find vulnerabilities in its web services, a much bigger reward than its previous policy of offering a company t-shirt. Read more at The Inquirer

Yahoo offers $15,000 to bug hunters
Yahoo is seeking to entice bug hunters with rewards up to $15,000 depending on the severity of the bug found. The web giant was criticized by security researchers for paying a measly $12.50 in Yahoo discount vouchers to security researchers at High-Tech Bridge for two cross site scripting (XSS) bugs they had reported. Yahoo's security head, Ramses Martinez, claimed later that he was behind the voucher reward program, and that he basically had been paying for them out of his own pocket. Read more at AfterDawn Oy

Following controversy, Yahoo officially launches bug bounty program
As promised, Yahoo formally kicked off its bug bounty program late last week, aiming to correct what many in the security industry viewed as misstep after it handed out a paltry $12.50 credit to a researcher for discovering a cross-site scripting error.

The company caught flak when in September when it was reported that the $12.50 – a scant prize as it is – came as a discount code that could be used toward Yahoo-branded merchandise like t-shirts, cups and pens from its store. Read more at Threatpost

HTB23176: Cross-Site Scripting (XSS) in GuppY

High-Tech Bridge Security Research Lab discovered two XSS vulnerabilities in GuppY, which can be exploited to perform Cross-Site Scripting attacks against users of vulnerable application.

Cross-Site Scripting (XSS) in GuppY vulnerability exists due to insufficient sanitisation of user-supplied data in "an" HTTP GET parameter passed to "/agenda.php" script. A remote attacker can trick a logged-in user to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.

The exploitation example below uses the "alert()" JavaScript function to display user's cookies:
http://[host]/agenda.php?agv=2&an=%22%20onmouseover%3dalert%28%27document.cookie%27%29%20%22

The second XSS vulnerability exists due to insufficient sanitisation of user-supplied data in "cat" HTTP GET parameter passed to "/mobile/thread.php" script. A remote attacker can trick a logged-in user to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.

The exploitation example below uses the "alert()" JavaScript function to display user's cookies:
http://[host]/mobile/thread.php?cat=1%22%20onmouseover%3dalert%28%27document.cookie%27%29%20%22

Solution: Update to GuppY 4.6.28

Source: High-Tech Bridge security advisory HTB23176.

HTB23175: Remote Code Execution in Microweber

High-Tech Bridge Security Research Lab discovered vulnerability in Microweber, which can be exploited to delete arbitrary files and compromise vulnerable system as a consequence.

Improper Access Control in Microweber: CVE-2013-5984 vulnerability exists due to improper access restriction to "/userfiles/modules/admin/backup/delete.php" script and insufficient validation of user-supplied input passed via "file" HTTP GET parameter.

A remote unauthenticated attacker can delete arbitrary files on the target system with privileges of the web server using directory traversal sequences and NULL byte.

The exploitation example below deletes the application's configuration file "config.php":
http://[host]/userfiles/modules/admin/backup/delete.php?file=../../../../../config.php

After deletion of the "config.php" file the application will suggest to re-install it from scratch when accessing "/index.php" file. Further exploitation of this vulnerability allows the attacker to reinstall the application and get full administrative access to it.

After successful re-installation the attacker can use "Admin Console" module of the application to execute arbitrary PHP code on the target system.

Simple exploit below displays output of "phpinfo()" PHP function after successful re-installation of application:
POST /module/ HTTP/1.1 module=admin%2Fconsole%2Fterm&data-type=admin%2Fconsole%2Fterm&id=mw_exec_term_command&c lass=+module++&exec_command=cGhwaW5mbw==&exec_command_params=MQ%3D%3D

Solution: Update to Microweber version 0.830

Source: High-Tech Bridge security advisory HTB23175.

HTB23174: Cross-Site Scripting (XSS) in Feng Office

Feng Office version 2.3.2-rc is vulnerable to perform cross-site-scripting attacks against users of vulnerable application.

The vulnerability exists due to insufficient sanitisation of user-supplied data in "ref_[any]" HTTP GET parameter passed to "/index.php" script. A remote attacker can trick a logged-in user to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.

Exploitation example and additional details are available on advisory page.

HTB23171: Gnew 2013.1 multiple vulnerabilities

Gnew version 2013.1 and probably prior suffers from PHP file inclusion and SQL injection vulnerabilities, which can be exploited to execute arbitrary PHP code and pefrom SQL injection attacks against vulnerable application.

PHP File Inclusion vulnerability in Gnew exists due to insufficient validation of user-supplied input passed via the "gnew_language" cookie to "users/login.php" script before using it in "include()" function. A remote attacker can include and execute arbitrary local files on a vulnerable system via directory traversal sequence and URL-encoded NULL byte.

SQL Injection vulnerabilities in Gnew exists due to insufficient filtration of "friend_email" to "news/send.php", "user_email" to "users/register.php", "answer_id" to "/polls/vote.php", "question_id" to "/polls/vote.php", "story_id" to "/comments/add.php", "story_id" to "/comments/edit.php", "thread_id" to "/posts/add.php", "thread_id" to "/posts/edit.php" POST parameters.

As a solution it is suggested to apply an unofficial patch, developed by High-Tech Bridge Security Research Lab and is available here: https://www.htbridge.com/advisory/HTB23171-patch.zip

Full advisory and additional details available here.

HTB23173: GLPI remote code execution

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in GLPI version 0.84.1, which can be exploited to bypass security restrictions and execute arbitrary PHP code with privileges of web server.

Improper access control vulnerability in GLPI exists due to insufficient access restrictions to the installation script "install/install.php", which is present by default after application installation. A remote attacker can change application’s configuration, such as database host, forcing the application to connect to an external database and spoof information on the website, obtain access to sensitive information or simply cause a denial of service.

Arbitrary PHP code injection vulnerability in GLPI exists due to insufficient validation of user-supplied input passed to the "db_host", "db_user", "db_pass", and "databasename" HTTP POST parameters via "install/install.php" script [that is present by default after application installation] before writing data into "config_db.php" file. A remote attacker can inject and execute arbitrary PHP code on the vulnerable system.

Solution: update to GLPI 0.84.2, all details with PoC examples available on security resercher's page.

HTB23172: X2CRM's multiple security vulnerabilities

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in X2CRM version 3.4.1, which can be exploited to include arbitrary local files and execute arbitrary PHP code, as well as to perform cross-site sripting (XSS) attacks against users of vulnerable application.

PHP File Inclusion vulnerability in X2CRM exists due to insufficient filtration of the "file" HTTP GET parameter passed to "index.php/admin/translationManager" URL before using it in PHP "include()" function. A remote authenticated administrator can include and execute arbitrary local PHP files on the target system using directory traversal sequences. Successful exploitation of this vulnerability requires administrative privileges, however it can be also exploited via CSRF vector to which the application is prone.

Cross-site scripting (XSS) vulnerability exists due to insufficient sanitisation of user-supplied data in "model" HTTP GET parameter passed to "index.php/admin/editor" URL. A remote attacker can trick a logged-in administrator to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.

Solution: Update to X2CRM 3.5 More information: www.htbridge.com/advisory/HTB23172.

HTB23168: vtiger CRM's SQL Injection

High-Tech Bridge Security Research Lab discovered SQL injection vulnerability in vtiger CRM version 5.4.0, which can be exploited to execute arbitrary SQL commands in application's database.

vtiger CRM is an on demand customer relationship management software that provides sales, marketing, and support teams with powerful tools to efficiently and effectively collaborate in providing the ideal customer experience.

This SQL injection vulnerability exists due to insufficient validation of "onlyforuser" HTTP GET parameter passed to "index.php" script. A remote authenticated user can execute arbitrary SQL commands in application's database. Successful exploitation of this vulnerability requires the attacker to be registered and logged-in. The registration is disabled by default. So severity of this issue has medium level with CVSSv2 Base Score 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P). Read full advisory and solution details on htbridge.com.

Nasdaq website security vulnerabilities

A penetration testing company uncovered security vulnerabilities on the NASDAQ website that remained open for two weeks after the stock exchange was notified.
NASDAQ Website Security Vulnerabilities Remained Open for Weeks After Alert (securityweek.com)

Exchange delayed fixing potentially critical website vulnerabilities despite multiple alerts, security firm says
Nasdaq waited two weeks to fix flaws (computerworld.com)

Ilia Kolochenko, head of Swiss information security company High-Tech Bridge, says he’s repeatedly warned Nasdaq.com that hackers could steal users’ browser history or confidential data, but claims the exchange has done nothing to fix the problem. 'It is quite frightening when you think about it,' he says.
Cypersecurity pro on Nasdaq website: 'I needed 10 minutes to hack' (nydailynews.com)

ImmuniWeb® Self-Fuzzer Firefox Extension

High-Tech Bridge announced new Firefox Addon: ImmuniWeb® Self-Fuzzer.

ImmuniWeb® Self-Fuzzer is a simple and free extension that fuzzes user's HTTP requests in real-time to detect SQLi and XSS vulnerabilities on a website, demonstrating how easily these 2 most common web weaknesses can be found by anyone.

Description in PDF format: PDF: ImmuniWeb® Self-Fuzzer Firefox Extension

ImmuniWeb® Self-Fuzzer Firefox Extension from High-Tech Bridge SA (HTBridge)

Also demo video available: