[Full-Disclosure] [waraxe-2004-SA#021 - Multiple vulnerabilities in phprofession 2.5 module for PostNuke]

From: Janek Vind (come2waraxe_at_yahoo.com)
Date: 04/21/04

  • Next message: Janek Vind: "[Full-Disclosure] [waraxe-2004-SA#022 - Multiple vulnerabilities in PostNuke 0.726 Phoenix - part 2]" 
    To: laserplaat@yahoo.com
Date: Wed, 21 Apr 2004 11:03:11 -0700 (PDT)

    {================================================================================}
    { [waraxe-2004-SA#021]
                              }
    {================================================================================}
    {
                              }
    { [ Multiple vulnerabilities in phprofession 2.5
    module for PostNuke ] }
    {
                              }
    {================================================================================}
                                                          
                                                          
                      
    Author: Janek Vind "waraxe"
    Date: 21. April 2004
    Location: Estonia, Tartu
    Web: http://www.waraxe.us/index.php?modname=sa&id=21

    Affected software description:
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    phprofession 2.5
    by Aidan Peiser
    Recruitment module for PN.712
    www.phpsolutions.co.uk
    https://sourceforge.net/projects/profession/

    Vulnerabilities:
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    A. Full path disclosure:

    If we make http request like this:

    http://localhost/postnuke0726/modules/phprofession/upload.php

    we will provoke php error messages:

    Warning: main(header.php): failed to open stream: No
    such file or directory in
    D:\apache_wwwroot\postnuke0726\modules\phprofession\upload.php
    on line 19
    Warning: main(): Failed opening 'header.php' for
    inclusion (include_path='.;c:\php4\pear') in
    D:\apache_wwwroot\postnuke0726\modules\phprofession\upload.php
    on line 19
    ...

    B. Cross-site scripting aka XSS:

    Unsanitaized variable "jcode" will open a way to
    exploit the XSS in phprofession:

    http://localhost/postnuke0726/modules.php?op=modload&name=phprofession&file=upload&jcode=[xss
    code here]

    Remark: successful exploiting of the XSS on PostNuke
    is possible only, if special measures to evade the
    XSS filters are used.

    C. Sql injection:

    Typical sql injection case, where injection occurs
    after ORDER BY keywords. This time the "weak point"
    is the vaiable "offset", but i have seen many scripts,
    where unsanitaized "limit" variable gets
    passed to sql query too. Good thing for webmasters
    (and bad for attackers) is, that in case of MySql
    version <= 4.0 there is no practical way to exploit
    this sql injection, other than failing it.
    Reason is, that after the "ORDER BY" keywords we can't
    use "UNION" and any other "useful" things.
    But in near future, when MySql version 4.1 will be in
    use, new feature will be present -
    subselects. And then can be possible using of the
    "half-blind" and "blind" methods to pull out
    any information from database, and that's WITHOUT
    "union" keyword.
      What's the point? Point is, that this sql injection
    is in this moment non-critical, but it's
    needed to fix as soon as possible.

    http://localhost/postnuke0726/modules.php?op=modload&name=phprofession&file=index&offset=foobar

    Error in query:
    SELECT phpro_joblisting.designation,
    phpro_joblisting.jcode, phpro_joblocation.location,
    phpro_jobsalary.salary, phpro_joblisting.posted
    from
    phpro_joblisting, phpro_joblocation, phpro_jobsalary
    WHERE phpro_joblisting.checked= 1
    AND phpro_joblocation.id =
    phpro_joblisting.fk_location
    AND phpro_jobsalary.id = phpro_joblisting.fk_salary
    AND DATE_ADD(posted, INTERVAL 80 DAY) > now()
    order by posted desc limit foobar,20.
    You have an error in your SQL syntax. Check the manual
    that corresponds to your
    MySQL server version for the right syntax to use near
    'foobar,20' at line 13

    Greetings:
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

        Greets to torufoorum members and to all bugtraq
    readers in Estonia! Tervitused!
    Special greets to UT Bee Clan members at
    http://bees.tk ! "Hold this position!" ;)

    Contact:
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

        come2waraxe@yahoo.com
        Janek Vind "waraxe"

        Homepage: http://www.waraxe.us/

    ---------------------------------- [ EOF ]
    ------------------------------------

            
                    
    __________________________________
    Do you Yahoo!?
    Yahoo! Photos: High-quality 4x6 digital prints for 25¢
    http://photos.yahoo.com/ph/print_splash

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: Janek Vind: "[Full-Disclosure] [waraxe-2004-SA#022 - Multiple vulnerabilities in PostNuke 0.726 Phoenix - part 2]"

    Relevant Pages