19.37.21 Secunia Research: AproxEngine Multiple Vulnerabilities | |
| ============================== Secunia Research 29/12/2009 - AproxEngine Multiple Vulnerabilities - ============================== Table of Contents Affected Software...................... Severity...................... Vendor's Description of Software...................... Description of Vulnerability................. Solution...................... Time Table......................... Credits....................... References.................... About Secunia....................... Verification.................. ============================== 1) Affected Software * AproxEngine 5.3.04 * AproxEngine 6.0 NOTE: Other versions may also be affected. ============================== 2) Severity Rating: Moderately critical Impact: SQL Injection Cross-Site Scripting Manipulation of Data Spoofing Where: Remote ============================== 3) Vendor's Description of Software "Die APROXEngine ist ein von uns entwickeltes Content-Management- System(CMS). Einfach gesagt, ist ein CMS ein Baukastensystem zur Erstellung, Wartung, Verwaltung von Internetseiten." Product Link: http://www.aprox.de/ ============================== 4) Description of Vulnerability Secunia Research has discovered some vulnerabilities in AproxEngine, which can be exploited by malicious users to manipulate certain data, conduct spoofing, SQL injection, and script insertion attacks and by malicious people to conduct SQL injection and script insertion attacks. 1) Input passed via the "login" parameter to index.php is not properly sanitised before being used in an SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. 2) Input passed via the "login" and "password" parameters to index.php is not properly sanitised before being displayed to the user. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed. 3) Input passed via the "art" parameter to index.php is not properly sanitised before being used in an SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. 4) Input passed via the "Referer" HTTP header to index.php is not properly sanitised before being used in an SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. 5) Input passed to the "datei" parameter in /engine/inc/ galerie_unlink.php is not properly verified before being used to delete image files. This can be exploited to delete arbitrary files via directory traversal attacks. Successful exploitation of this vulnerability requires administrative privileges. 6) Input passed to the "del_verz" parameter in /engine/inc/ galerie_del_verz.php is not properly verified before being used to delete galleries. This can be exploited to delete arbitrary directories via directory traversal attacks. Successful exploitation of this vulnerability requires administrative privileges. 7) Input passed via the "from" parameter to index.php (when "page" is set to "sql_postfach" and "action" is set to "new") is not properly verified before being used to send mails to users. This can be exploited to e.g. spoof mails from the administrator. 8) Input passed via the "to", "betreff", and "elm1" parameters to index.php (when "page" is set to "sql_postfach" and "action" is set to "new") is not properly sanitised before being used in an SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. 9) Input passed via various parameters to index.php (when "page" is set to "sql_profil" and "action" is set to "list") is not properly sanitised before being used in an SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. Successful exploitation of this vulnerability on version 6.0 requires administrative privileges. 10) Input passed via the "generator", "author", "description", and "keywords" parameters to index.php (when "page" is set to "user_html_ed" and "action" is set to "open") is not properly sanitised before being used in an SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. 11) Input passed via the "generator", "author", "description", and "keywords" parameters to index.php (when "page" is set to "user_html_ed" and "action" is set to "open") is not properly sanitised before being displayed to the user. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed. 12) Input passed via the "mail" parameter to index.php (when "page" is set to "sql_profil" and "action" is set to "list") is not properly sanitised before being displayed to the user. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed. Successful exploitation of this vulnerability on version 6.0 requires administrative privileges. 13) Input passed via the "betreff" parameter to index.php (when "page" is set to "sql_postfach" and "action" is set to "new") is not properly sanitised before being displayed to the user. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed. The vulnerabilities are confirmed in versions 5.3.04 and 6.0. Other versions may also be affected. NOTE: Successful exploitation of all vulnerabilities except #5 and #6 requires that "magic_quotes_gpc" is disabled. ============================== 5) Solution Ensure that "magic_quotes_gpc" is enabled and grant only trusted users administrative access to the application. ============================== 6) Time Table 04/12/2009 - Vendor notified. 23/12/2009 - Vendor notified again (2nd attempt). 29/12/2009 - Public disclosure. ============================== 7) Credits Discovered by Chaitanya Sharma, Secunia. ============================== 8) References The Common Vulnerabilities and Exposures (CVE) project has not currently assigned any CVE identifiers for these vulnerabilities. ============================== 9) About Secunia Secunia offers vulnerability management solutions to corporate customers with verified and reliable vulnerability intelligence relevant to their specific system configuration: http://secunia.com/advisories/ Secunia also provides a publicly accessible and comprehensive advisory database as a service to the security community and private individuals, who are interested in or concerned about IT-security. http://secunia.com/advisories/ Secunia believes that it is important to support the community and to do active vulnerability research in order to aid improving the security and reliability of software in general: http://secunia.com/secunia_ Secunia regularly hires new skilled team members. Check the URL below to see currently vacant positions: http://secunia.com/corporate/ Secunia offers a FREE mailing list called Secunia Security Advisories: http://secunia.com/advisories/ ============================== 10) Verification Please verify this advisory by visiting the Secunia website: http://secunia.com/secunia_ Complete list of vulnerability reports published by Secunia Research: http://secunia.com/secunia_ ============================== | |
|
| |
| Total comments: 0 | |