Aoop CMS 0.3.6 SQL Injection / Cross Site Scripting

`Inshell Security Advisory  
http://www.inshell.net  
  
  
1. ADVISORY INFORMATION  
-----------------------  
Product: Aoop CMS  
Vendor URL: www.annonyme.de  
Type: Cross-site Scripting [CWE-79], SQL-Injection [CWE-89]  
Date found: 2012-04-07  
Date published: 2012-08-24  
CVSSv2 Score: 7,5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) (highest)  
CVE: -  
  
  
2. CREDITS  
----------  
The vulnerabilities were discovered and researched by Julien Ahrens from  
Inshell Security.  
  
  
3. VERSIONS AFFECTED  
--------------------  
Aoop CMS v0.3.6, older versions may be affected too.  
  
  
4. VULNERABILITY DESCRIPTION  
----------------------------  
Aoop CMS v0.3.6 is affected by multiple SQL-Injection and Cross-Site  
Scripting vulnerabilites.  
  
  
## SQL-Injection Vulnerabilities ##  
  
Pre-Auth:  
http://localhost/index.php?print=download&page=Photos&sub=loadAndShowPhoto&picId=[SQLi]  
  
Post-Auth:  
http://localhost/index.php?page=users&sub=readMessage&msgId=[SQLi]  
http://localhost/index.php?page=users&sub=newMessage&messageId=[SQLi]  
http://localhost/index.php?page=users&sub=deleteMessage&messageId=[SQLi]  
http://localhost/index.php?page=EProjects&sub=editRFC&rfcId=[SQLi]&projectId=18  
  
Due to improper input - validation of these GET parameters, an attacker  
could inject own arbitrary SQL statements without or with required  
authentication. Successful exploitation of these vulnerabilities could  
result in a complete database / web-application compromise or data theft.  
  
  
## Cross-Site Scripting Vulnerabilities ##  
  
Non-Persistent (GET):  
http://localhost/index.php?page=Photos&sub=search&pattern="><script>alert(String.fromCharCode(88,83,83))</script>  
  
Non-Persistent (POST):  
http://localhost/index.php?page=Photos&sub=search (Field:  
"Pattern",payload="><script>alert(1)</script>)  
  
Due to improper input - validation of these GET/POST parameters, an  
attacker could temporarily inject arbitrary code using required user  
interaction into the context of the website/current browser session.  
Successful exploitation of these vulnerabilities allows for example  
session hijacking or client side context manipulation.  
  
  
Persistent:  
http://localhost/index.php?page=users&sub=extendUserProfile (Field:  
"profileItemName", "profileItemValue">  
http://localhost/index.php?page=EProjects&sub=viewProject&projectId=18  
(Field: "name","official_link")  
http://localhost/index.php?page=Photos&sub=uploadPic (Field: "Title")  
  
Due to improper input - validation of these input fields, an attacker  
could permanently inject arbitrary code using an own registered  
user-account into the context of the website. Successful exploitation of  
these vulnerabilities allows for example session hijacking or server  
side context manipulation.  
  
  
5. PROOF-OF-CONCEPT (CODE / Exploit)  
------------------------------------  
For further screenshots and/or PoCs visit:  
http://security.inshell.net/advisory/23  
  
  
6. SOLUTION  
-----------  
Update to v0.4 RC3  
  
  
7. REPORT TIMELINE  
------------------  
2012-04-07: Initial notification sent to vendor  
2012-04-08: Vendor Response / Feedback  
2012-07-29: Vendor releases v0.4 RC3 which fixes the vulnerabilities  
2012-08-24: Coordinated public release of advisory  
  
  
8. REFERENCES  
-------------  
http://security.inshell.net  
`