HTB23177: SQL Injection in appRain

High-Tech Bridge Security Research Lab discovered vulnerability in appRain, which can be exploited to perform SQL Injection attacks.

Blind SQL Injection vulnerability in appRain is caused by insufficient validation of user-supplied data appended to "/blog-by-cat/" URL. Remote attacker can execute arbitrary SQL commands to read, modify or delete information in application's database.

The following exploitation example will display all posts from category 1, if the MySQL Server version is 5.x, otherwise no posts will be displayed:
http://[host]/blog-by-cat/1%20and%20substring(version(),1,1)=5/

Solution: Vendor did not reply to notifications, unofficial patch was developed by High-Tech Bridge Security Research Lab and is available here: https://www.htbridge.com/advisory/HTB23177-patch.zip

Source: High-Tech Bridge Advisory HTB23177 - SQL Injection in appRain.

Yahoo launches $15,000 bug bounty program

Yahoo launches $15,000 bug bounty after $12.50 company voucher debacle
Web portal Yahoo launched a bug bounty programme on Friday following the scandal that unravelled last month, which saw a security firm rewarded with a $12.50 Yahoo Company Store voucher for uncovering a security flaw.

In what is good news for security researchers, Yahoo said that the bounty programme will now pay up to $15,000 to ethical hackers who find vulnerabilities in its web services, a much bigger reward than its previous policy of offering a company t-shirt. Read more at The Inquirer

Yahoo offers $15,000 to bug hunters
Yahoo is seeking to entice bug hunters with rewards up to $15,000 depending on the severity of the bug found. The web giant was criticized by security researchers for paying a measly $12.50 in Yahoo discount vouchers to security researchers at High-Tech Bridge for two cross site scripting (XSS) bugs they had reported. Yahoo's security head, Ramses Martinez, claimed later that he was behind the voucher reward program, and that he basically had been paying for them out of his own pocket. Read more at AfterDawn Oy

Following controversy, Yahoo officially launches bug bounty program
As promised, Yahoo formally kicked off its bug bounty program late last week, aiming to correct what many in the security industry viewed as misstep after it handed out a paltry $12.50 credit to a researcher for discovering a cross-site scripting error.

The company caught flak when in September when it was reported that the $12.50 – a scant prize as it is – came as a discount code that could be used toward Yahoo-branded merchandise like t-shirts, cups and pens from its store. Read more at Threatpost

HTB23176: Cross-Site Scripting (XSS) in GuppY

High-Tech Bridge Security Research Lab discovered two XSS vulnerabilities in GuppY, which can be exploited to perform Cross-Site Scripting attacks against users of vulnerable application.

Cross-Site Scripting (XSS) in GuppY vulnerability exists due to insufficient sanitisation of user-supplied data in "an" HTTP GET parameter passed to "/agenda.php" script. A remote attacker can trick a logged-in user to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.

The exploitation example below uses the "alert()" JavaScript function to display user's cookies:
http://[host]/agenda.php?agv=2&an=%22%20onmouseover%3dalert%28%27document.cookie%27%29%20%22

The second XSS vulnerability exists due to insufficient sanitisation of user-supplied data in "cat" HTTP GET parameter passed to "/mobile/thread.php" script. A remote attacker can trick a logged-in user to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.

The exploitation example below uses the "alert()" JavaScript function to display user's cookies:
http://[host]/mobile/thread.php?cat=1%22%20onmouseover%3dalert%28%27document.cookie%27%29%20%22

Solution: Update to GuppY 4.6.28

Source: High-Tech Bridge security advisory HTB23176.

HTB23175: Remote Code Execution in Microweber

High-Tech Bridge Security Research Lab discovered vulnerability in Microweber, which can be exploited to delete arbitrary files and compromise vulnerable system as a consequence.

Improper Access Control in Microweber: CVE-2013-5984 vulnerability exists due to improper access restriction to "/userfiles/modules/admin/backup/delete.php" script and insufficient validation of user-supplied input passed via "file" HTTP GET parameter.

A remote unauthenticated attacker can delete arbitrary files on the target system with privileges of the web server using directory traversal sequences and NULL byte.

The exploitation example below deletes the application's configuration file "config.php":
http://[host]/userfiles/modules/admin/backup/delete.php?file=../../../../../config.php

After deletion of the "config.php" file the application will suggest to re-install it from scratch when accessing "/index.php" file. Further exploitation of this vulnerability allows the attacker to reinstall the application and get full administrative access to it.

After successful re-installation the attacker can use "Admin Console" module of the application to execute arbitrary PHP code on the target system.

Simple exploit below displays output of "phpinfo()" PHP function after successful re-installation of application:
POST /module/ HTTP/1.1 module=admin%2Fconsole%2Fterm&data-type=admin%2Fconsole%2Fterm&id=mw_exec_term_command&c lass=+module++&exec_command=cGhwaW5mbw==&exec_command_params=MQ%3D%3D

Solution: Update to Microweber version 0.830

Source: High-Tech Bridge security advisory HTB23175.

HTB23174: Cross-Site Scripting (XSS) in Feng Office

Feng Office version 2.3.2-rc is vulnerable to perform cross-site-scripting attacks against users of vulnerable application.

The vulnerability exists due to insufficient sanitisation of user-supplied data in "ref_[any]" HTTP GET parameter passed to "/index.php" script. A remote attacker can trick a logged-in user to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.

Exploitation example and additional details are available on advisory page.

HTB23171: Gnew 2013.1 multiple vulnerabilities

Gnew version 2013.1 and probably prior suffers from PHP file inclusion and SQL injection vulnerabilities, which can be exploited to execute arbitrary PHP code and pefrom SQL injection attacks against vulnerable application.

PHP File Inclusion vulnerability in Gnew exists due to insufficient validation of user-supplied input passed via the "gnew_language" cookie to "users/login.php" script before using it in "include()" function. A remote attacker can include and execute arbitrary local files on a vulnerable system via directory traversal sequence and URL-encoded NULL byte.

SQL Injection vulnerabilities in Gnew exists due to insufficient filtration of "friend_email" to "news/send.php", "user_email" to "users/register.php", "answer_id" to "/polls/vote.php", "question_id" to "/polls/vote.php", "story_id" to "/comments/add.php", "story_id" to "/comments/edit.php", "thread_id" to "/posts/add.php", "thread_id" to "/posts/edit.php" POST parameters.

As a solution it is suggested to apply an unofficial patch, developed by High-Tech Bridge Security Research Lab and is available here: https://www.htbridge.com/advisory/HTB23171-patch.zip

Full advisory and additional details available here.

HTB23173: GLPI remote code execution

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in GLPI version 0.84.1, which can be exploited to bypass security restrictions and execute arbitrary PHP code with privileges of web server.

Improper access control vulnerability in GLPI exists due to insufficient access restrictions to the installation script "install/install.php", which is present by default after application installation. A remote attacker can change application’s configuration, such as database host, forcing the application to connect to an external database and spoof information on the website, obtain access to sensitive information or simply cause a denial of service.

Arbitrary PHP code injection vulnerability in GLPI exists due to insufficient validation of user-supplied input passed to the "db_host", "db_user", "db_pass", and "databasename" HTTP POST parameters via "install/install.php" script [that is present by default after application installation] before writing data into "config_db.php" file. A remote attacker can inject and execute arbitrary PHP code on the vulnerable system.

Solution: update to GLPI 0.84.2, all details with PoC examples available on security resercher's page.