w-agora.txt

`http://www.maxpatrol.com/mp_advisory.asp  
  
Title: Multiple vulnerabilities in w-agora forum  
Date: 28.09.04  
Severity: Medium  
Application: w-agora 4.1.6a, http://www.w-agora/en/download.php  
Platform: PHP  
  
I. DESCRIPTION  
  
Multiple vulnerabilities were found in w-agora forum. A remote user   
can conduct SQL injection attack, HTTP response splitting and Cross  
site   
Scripting attack.  
  
1. SQL injection  
  
redir_url.php?bn=demos_links&key=[SQL]  
  
2. XSS in GET:  
  
download_thread.php?site=support&bn=support_install&thread=[XSS   
code here]  
  
3. XSS in POST:  
  
  
POST /login.php HTTP/1.1  
Host: w-agora  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 89  
loginform=1&redirect_url=1&loginuser=[XSS code here]&loginpassword=1  
  
  
POST /forgot_password.php HTTP/1.1  
Host: w-agora  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 48  
go=1&userid=[XSS code here]  
  
  
4. HTTP response splitting  
  
/subscribe_thread.php?site=support&bn=support_in  
  
stall&thread=%0d%0aContent-Length:%200%0d%0a%0d%0a%20200%20OK%0d%0aConte  
nt-Type:%20text/html%0d%0aContent-Length:%2034%0d%0a%0d%0a%3chtml%3eScan  
ned%20by%20PTsecurity%3c/html%3e%0d%0a  
  
5. Path discourse  
/list.php?bn=support_install&last=19&collapse=|id|  
  
II. IMPACT  
  
----------  
A remote user can access the target user's cookies (including  
authentication cookies).   
A remote user can cause SQL commands to be executed by the underlying  
database.  
  
III. SOLUTION  
  
-------------  
Yes  
  
  
  
IV. VENDOR FIX/RESPONSE  
  
-----------------------  
  
  
Yes, Fixed in CVS : subscribe_thread.php3,v 1.17, forgot_password.php3  
v1.17, include/auth.php v1.45, list.php3 v1.53,   
  
  
V. CREDIT  
  
-------------  
  
This vulnerability was discovered by Positive Technologies using  
MaxPatrol (www.maxpatrol.com) - intellectual professional security  
scanner. It is able to detect a substantial amount of vulnerabilities  
not published yet. MaxPatrol's intelligent algorithms are also capable  
to detect a lot of vulnerabilities in custom web-scripts (XSS, SQL and  
code injections, HTTP Response splitting and other).  
  
`