[Bkis-13-2009] e107 Multiple Vulnerabilities

[Bkis-13-2009] e107 Multiple Vulnerabilities

1. General Information
   e107 is a free content management system (CMS) written in PHP language
   and is available at http://e107.org/news.php . In October 2009, Bkis
   Security discovered a number of XSS and Blind SQL Injection
   vulnerabilities on this system. Taking advantage of these holes, hackers
   can insert arbitrary malicious codes onto users' browsers, then steal
   private information or carry out requests to the website to gain
   complete control of the website's database.

Details: http://blog.bkis.com/e107-multiple-vulnerabilities/
SVRT Advisory: Bkis-13-2009
Initial vendor notification: 10/28/09
Release Date: 11/23/09
Update Date: 11/23/09
Discovered by: Do Hoang Bach, Bkis
Attack Type: XSS, SQL Injection
Security Rating: High
Impact: Code Execution
Affected Software: E107 (ver <= 0.7.16)

2. Technical details
   The found XSS holes reside in the following modules:

• submitnews.php
• usersettings.php.
• e107_admin/newpost.php.
• e107_admin/banlist.php.
• e107_admin/banner.php.
• e107_admin/cpage.php
• e107_admin/download.php.
• e107_admin/users_extended.php.
• e107_admin/frontpage.php.
• e107_admin/links.php.
• e107_admin/mailout.php.

To be specific, the flaws on these modules are results of inadequate
check of input variables, allowing hackers to insert scripts onto the
links before sending them to e107's users. When users log in to e107 and
click on these links, the malicious codes will be executed on their
browsers. By this way, hackers can harvest cookies, sessions, etc on
the infected machines and, therefore, are able to steal secret
information of users.

The Blind SQL Injection hole lies in Search function of the website.
Exploiting this hole, hackers can carry out any requests to the website
and get the complete control of the its database.

3. Solution
   As these are dangerous vulnerabilities, Bkis has notified e107's
   developer of the problem. Besides, we recommend that individuals,
   organizations using e107 be cautious of links from unclear origins, and
   regularly check for patch on e107's website.

http://blog.bkis.com