{"id": "SECURITYVULNS:DOC:29327", "bulletinFamily": "software", "title": "SQL Injection in b2evolution", "description": "\r\n\r\nAdvisory ID: HTB23152\r\nProduct: b2evolution\r\nVendor: b2evolution Group\r\nVulnerable Version(s): 4.1.6 and probably prior\r\nTested Version: 4.1.6\r\nVendor Notification: April 10, 2013 \r\nVendor Patch: April 29, 2013 \r\nPublic Disclosure: May 1, 2013 \r\nVulnerability Type: SQL Injection [CWE-89]\r\nCVE Reference: CVE-2013-2945\r\nRisk Level: Medium \r\nCVSSv2 Base Score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)\r\nSolution Status: Fixed by Vendor\r\nDiscovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ ) \r\n\r\n-----------------------------------------------------------------------------------------------\r\n\r\nAdvisory Details:\r\n\r\nHigh-Tech Bridge Security Research Lab discovered SQL injection vulnerability in b2evolution, which can be exploited to alter SQL requests passed to the vulnerable application's database.\r\n\r\n\r\n1) SQL Injection in b2evolution: CVE-2013-2945\r\n\r\nThe vulnerability exists due to insufficient validation of HTTP GET parameter "show_statuses" in "/blogs/admin.php" script. A remote authenticated administrator can execute arbitrary SQL commands in application's database.\r\n\r\nDepending on database and system configuration, PoC code below will create a "/tmp/file.txt" file, containing MySQL version:\r\n\r\nhttp://[host]/blogs/admin.php?submit=Search&ctrl=items&tab=full&blog=1&show_statuses[]=1') )) UNION SELECT version() INTO OUTFILE '/tmp/file.txt' -- \r\n\r\n\r\nThis vulnerability is also exploitable via CSRF vector, since the application is prone to Cross-Site Request Forgery (CSRF) attacks. In order to do so an attacker should trick a logged-in administrator to visit malicious web page with CSRF exploit.\r\n\r\nBasic CSRF exploit:\r\n\r\n<img src="http://[host]/blogs/admin.php?submit=Search&ctrl=items&tab=full&blog=1&show_statuses[]=1') )) UNION SELECT version() INTO OUTFILE '/tmp/file.txt' --"> \r\n\r\n\r\n-----------------------------------------------------------------------------------------------\r\n\r\nSolution:\r\n\r\nUpgrade to b2evolution 4.1.7\r\n\r\nMore Information:\r\nhttp://b2evolution.net/news/2013/04/29/b2evolution-4-1-7-and-5-0-3\r\n\r\n-----------------------------------------------------------------------------------------------\r\n\r\nReferences:\r\n\r\n[1] High-Tech Bridge Advisory HTB23152 - https://www.htbridge.com/advisory/HTB23152 - SQL Injection in b2evolution\r\n[2] b2evolution - http://b2evolution.net/ - A powerful free blog/CMS engine you can install on your own website.\r\n[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE\u00ae is a dictionary of publicly known information security vulnerabilities and exposures.\r\n[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types. \r\n\r\n-----------------------------------------------------------------------------------------------\r\n\r\nDisclaimer: The information provided in this Advisory is provided "as is" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References.\r\n", "published": "2013-05-06T00:00:00", "modified": "2013-05-06T00:00:00", "cvss": {"score": 6.5, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:29327", "reporter": "Securityvulns", "references": [], "cvelist": ["CVE-2013-2945"], "type": "securityvulns", "lastseen": "2018-08-31T11:10:47", "history": [], "edition": 1, "hashmap": [{"key": "affectedSoftware", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "bulletinFamily", "hash": "f9fa10ba956cacf91d7878861139efb9"}, {"key": "cvelist", "hash": "e11c436f8379dec0e0c4792478e81fe6"}, {"key": "cvss", "hash": "9acfc3ecd06539a3534549fd05dfad8e"}, {"key": "description", "hash": "9eb61c17728aac413b589cd93d6621b0"}, {"key": "href", "hash": "0a8fdec95226a9d17cb02e29ce04f17f"}, {"key": "modified", "hash": "0a214499ef1b5fa275fb7efdc18dd5e5"}, {"key": "published", "hash": "0a214499ef1b5fa275fb7efdc18dd5e5"}, {"key": "references", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "reporter", "hash": "a49ebb2e1a771348dfa0039e0d589df6"}, {"key": "title", "hash": "423235f56e4c7f6501f43d314943e822"}, {"key": "type", "hash": "d54751dd75af2ea0147b462b3e001cd0"}], "hash": "0617443d746add202480a69603fe86f94b9c0690924f4019093e9db14fd8a0d9", "viewCount": 2, "enchantments": {"score": {"value": 6.8, "vector": "NONE", "modified": "2018-08-31T11:10:47"}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2013-2945"]}, {"type": "htbridge", "idList": ["HTB23152"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:121481"]}, {"type": "exploitdb", "idList": ["EDB-ID:25298"]}, {"type": "zdt", "idList": ["1337DAY-ID-20723"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:13053"]}], "modified": "2018-08-31T11:10:47"}, "vulnersScore": 6.8}, "objectVersion": "1.3", "affectedSoftware": []}

{"cve": [{"lastseen": "2017-08-29T10:47:48", "bulletinFamily": "NVD", "description": "SQL injection vulnerability in blogs/admin.php in b2evolution before 4.1.7 allows remote authenticated administrators to execute arbitrary SQL commands via the show_statuses[] parameter. NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL commands.", "modified": "2017-08-28T21:33:17", "published": "2014-04-02T12:17:06", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-2945", "id": "CVE-2013-2945", "title": "CVE-2013-2945", "type": "cve", "cvss": {"score": 6.5, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "htbridge": [{"lastseen": "2017-06-23T23:08:16", "bulletinFamily": "software", "description": "High-Tech Bridge Security Research Lab discovered SQL injection vulnerability in b2evolution, which can be exploited to alter SQL requests passed to the vulnerable application's database. \n \n1) SQL Injection in b2evolution: CVE-2013-2945 \nThe vulnerability exists due to insufficient validation of HTTP GET parameter \"show_statuses\" in \"/blogs/admin.php\" script. A remote authenticated administrator can execute arbitrary SQL commands in application's database. \nDepending on database and system configuration, PoC code below will create a \"/tmp/file.txt\" file, containing MySQL version: \nhttp://[host]/blogs/admin.php?submit=Search&amp;ctrl=items&amp;tab=full&amp;blog=1&amp;show_ statuses[]=1') )) UNION SELECT version() INTO OUTFILE '/tmp/file.txt' -- \n \nThis vulnerability is also exploitable via CSRF vector, since the application is prone to Cross-Site Request Forgery (CSRF) attacks. In order to do so an attacker should trick a logged-in administrator to visit malicious web page with CSRF exploit. \nBasic CSRF exploit: \n&lt;img src=\"http://[host]/blogs/admin.php?submit=Search&amp;ctrl=items&amp;tab=full&amp;blog=1&amp; show_statuses[]=1') )) UNION SELECT version() INTO OUTFILE '/tmp/file.txt' --\"&gt; \n\n", "modified": "2013-04-30T00:00:00", "published": "2013-04-10T00:00:00", "id": "HTB23152", "href": "https://www.htbridge.com/advisory/HTB23152", "type": "htbridge", "title": "SQL Injection in b2evolution", "cvss": {"score": 5.1, "vector": "AV:N/AC:H/Au:N/C:P/I:P/A:P/"}}], "packetstorm": [{"lastseen": "2016-12-05T22:19:25", "bulletinFamily": "exploit", "description": "", "modified": "2013-05-01T00:00:00", "published": "2013-05-01T00:00:00", "href": "https://packetstormsecurity.com/files/121481/b2evolution-4.1.6-SQL-Injection.html", "id": "PACKETSTORM:121481", "type": "packetstorm", "title": "b2evolution 4.1.6 SQL Injection", "sourceData": "`Advisory ID: HTB23152 \nProduct: b2evolution \nVendor: b2evolution Group \nVulnerable Version(s): 4.1.6 and probably prior \nTested Version: 4.1.6 \nVendor Notification: April 10, 2013 \nVendor Patch: April 29, 2013 \nPublic Disclosure: May 1, 2013 \nVulnerability Type: SQL Injection [CWE-89] \nCVE Reference: CVE-2013-2945 \nRisk Level: Medium \nCVSSv2 Base Score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P) \nSolution Status: Fixed by Vendor \nDiscovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ ) \n \n----------------------------------------------------------------------------------------------- \n \nAdvisory Details: \n \nHigh-Tech Bridge Security Research Lab discovered SQL injection vulnerability in b2evolution, which can be exploited to alter SQL requests passed to the vulnerable application's database. \n \n \n1) SQL Injection in b2evolution: CVE-2013-2945 \n \nThe vulnerability exists due to insufficient validation of HTTP GET parameter \"show_statuses\" in \"/blogs/admin.php\" script. A remote authenticated administrator can execute arbitrary SQL commands in application's database. \n \nDepending on database and system configuration, PoC code below will create a \"/tmp/file.txt\" file, containing MySQL version: \n \nhttp://[host]/blogs/admin.php?submit=Search&ctrl=items&tab=full&blog=1&show_statuses[]=1') )) UNION SELECT version() INTO OUTFILE '/tmp/file.txt' -- \n \n \nThis vulnerability is also exploitable via CSRF vector, since the application is prone to Cross-Site Request Forgery (CSRF) attacks. In order to do so an attacker should trick a logged-in administrator to visit malicious web page with CSRF exploit. \n \nBasic CSRF exploit: \n \n<img src=\"http://[host]/blogs/admin.php?submit=Search&ctrl=items&tab=full&blog=1&show_statuses[]=1') )) UNION SELECT version() INTO OUTFILE '/tmp/file.txt' --\"> \n \n \n----------------------------------------------------------------------------------------------- \n \nSolution: \n \nUpgrade to b2evolution 4.1.7 \n \nMore Information: \nhttp://b2evolution.net/news/2013/04/29/b2evolution-4-1-7-and-5-0-3 \n \n----------------------------------------------------------------------------------------------- \n \nReferences: \n \n[1] High-Tech Bridge Advisory HTB23152 - https://www.htbridge.com/advisory/HTB23152 - SQL Injection in b2evolution \n[2] b2evolution - http://b2evolution.net/ - A powerful free blog/CMS engine you can install on your own website. \n[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE\u00ae is a dictionary of publicly known information security vulnerabilities and exposures. \n[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types. \n \n----------------------------------------------------------------------------------------------- \n \nDisclaimer: The information provided in this Advisory is provided \"as is\" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References. \n`\n", "cvss": {"score": 6.5, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "sourceHref": "https://packetstormsecurity.com/files/download/121481/b2evolution-sql.txt"}], "zdt": [{"lastseen": "2018-03-06T01:38:12", "bulletinFamily": "exploit", "description": "b2evolution version 4.1.6 suffers from remote SQL injection and cross site request forgery vulnerabilities.", "modified": "2013-05-02T00:00:00", "published": "2013-05-02T00:00:00", "id": "1337DAY-ID-20723", "href": "https://0day.today/exploit/description/20723", "type": "zdt", "title": "b2evolution 4.1.6 SQL Injection Vulnerability", "sourceData": "Product: b2evolution\r\nVendor: b2evolution Group\r\nVulnerable Version(s): 4.1.6 and probably prior\r\nTested Version: 4.1.6\r\nVendor Notification: April 10, 2013 \r\nVendor Patch: April 29, 2013 \r\nPublic Disclosure: May 1, 2013 \r\nVulnerability Type: SQL Injection [CWE-89]\r\nCVE Reference: CVE-2013-2945\r\nRisk Level: Medium \r\nCVSSv2 Base Score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)\r\nSolution Status: Fixed by Vendor\r\nDiscovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ ) \r\n\r\n-----------------------------------------------------------------------------------------------\r\n\r\nAdvisory Details:\r\n\r\nHigh-Tech Bridge Security Research Lab discovered SQL injection vulnerability in b2evolution, which can be exploited to alter SQL requests passed to the vulnerable application's database.\r\n\r\n\r\n1) SQL Injection in b2evolution: CVE-2013-2945\r\n\r\nThe vulnerability exists due to insufficient validation of HTTP GET parameter \"show_statuses\" in \"/blogs/admin.php\" script. A remote authenticated administrator can execute arbitrary SQL commands in application's database.\r\n\r\nDepending on database and system configuration, PoC code below will create a \"/tmp/file.txt\" file, containing MySQL version:\r\n\r\nhttp://[host]/blogs/admin.php?submit=Search&ctrl=items&tab=full&blog=1&show_statuses[]=1') )) UNION SELECT version() INTO OUTFILE '/tmp/file.txt' -- \r\n\r\n\r\nThis vulnerability is also exploitable via CSRF vector, since the application is prone to Cross-Site Request Forgery (CSRF) attacks. In order to do so an attacker should trick a logged-in administrator to visit malicious web page with CSRF exploit.\r\n\r\nBasic CSRF exploit:\r\n\r\n<img src=\"http://[host]/blogs/admin.php?submit=Search&ctrl=items&tab=full&blog=1&show_statuses[]=1') )) UNION SELECT version() INTO OUTFILE '/tmp/file.txt' --\"> \r\n\r\n\r\n-----------------------------------------------------------------------------------------------\r\n\r\nSolution:\r\n\r\nUpgrade to b2evolution 4.1.7\r\n\r\nMore Information:\r\nhttp://b2evolution.net/news/2013/04/29/b2evolution-4-1-7-and-5-0-3\r\n\r\n-----------------------------------------------------------------------------------------------\n\n# 0day.today [2018-03-05] #", "cvss": {"score": 6.5, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "sourceHref": "https://0day.today/exploit/20723"}], "exploitdb": [{"lastseen": "2016-02-03T01:04:02", "bulletinFamily": "exploit", "description": "b2evolution 4.1.6 - Multiple Vulnerabilities. CVE-2013-2945. Webapps exploit for php platform", "modified": "2013-05-07T00:00:00", "published": "2013-05-07T00:00:00", "id": "EDB-ID:25298", "href": "https://www.exploit-db.com/exploits/25298/", "type": "exploitdb", "title": "b2evolution 4.1.6 - Multiple Vulnerabilities", "sourceData": "Advisory ID: HTB23152\r\nProduct: b2evolution\r\nVendor: b2evolution Group\r\nVulnerable Version(s): 4.1.6 and probably prior\r\nTested Version: 4.1.6\r\nVendor Notification: April 10, 2013 \r\nVendor Patch: April 29, 2013 \r\nPublic Disclosure: May 1, 2013 \r\nVulnerability Type: SQL Injection [CWE-89]\r\nCVE Reference: CVE-2013-2945\r\nRisk Level: Medium \r\nCVSSv2 Base Score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)\r\nSolution Status: Fixed by Vendor\r\nDiscovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ ) \r\n\r\n-----------------------------------------------------------------------------------------------\r\n\r\nAdvisory Details:\r\n\r\nHigh-Tech Bridge Security Research Lab discovered SQL injection vulnerability in b2evolution, which can be exploited to alter SQL requests passed to the vulnerable application's database.\r\n\r\n\r\n1) SQL Injection in b2evolution: CVE-2013-2945\r\n\r\nThe vulnerability exists due to insufficient validation of HTTP GET parameter \"show_statuses\" in \"/blogs/admin.php\" script. A remote authenticated administrator can execute arbitrary SQL commands in application's database.\r\n\r\nDepending on database and system configuration, PoC code below will create a \"/tmp/file.txt\" file, containing MySQL version:\r\n\r\nhttp://[host]/blogs/admin.php?submit=Search&ctrl=items&tab=full&blog=1&show_statuses[]=1') )) UNION SELECT version() INTO OUTFILE '/tmp/file.txt' -- \r\n\r\n\r\nThis vulnerability is also exploitable via CSRF vector, since the application is prone to Cross-Site Request Forgery (CSRF) attacks. In order to do so an attacker should trick a logged-in administrator to visit malicious web page with CSRF exploit.\r\n\r\nBasic CSRF exploit:\r\n\r\n<img src=\"http://[host]/blogs/admin.php?submit=Search&ctrl=items&tab=full&blog=1&show_statuses[]=1') )) UNION SELECT version() INTO OUTFILE '/tmp/file.txt' --\"> \r\n\r\n\r\n-----------------------------------------------------------------------------------------------\r\n\r\nSolution:\r\n\r\nUpgrade to b2evolution 4.1.7\r\n\r\nMore Information:\r\nhttp://b2evolution.net/news/2013/04/29/b2evolution-4-1-7-and-5-0-3\r\n\r\n-----------------------------------------------------------------------------------------------\r\n\r\nReferences:\r\n\r\n[1] High-Tech Bridge Advisory HTB23152 - https://www.htbridge.com/advisory/HTB23152 - SQL Injection in b2evolution\r\n[2] b2evolution - http://b2evolution.net/ - A powerful free blog/CMS engine you can install on your own website.\r\n[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE\u00c2\u017d is a dictionary of publicly known information security vulnerabilities and exposures.\r\n[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types. \r\n\r\n-----------------------------------------------------------------------------------------------\r\n\r\nDisclaimer: The information provided in this Advisory is provided \"as is\" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References.", "cvss": {"score": 6.5, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "sourceHref": "https://www.exploit-db.com/download/25298/"}], "securityvulns": [{"lastseen": "2018-08-31T11:09:51", "bulletinFamily": "software", "description": "PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc.", "modified": "2013-05-06T00:00:00", "published": "2013-05-06T00:00:00", "id": "SECURITYVULNS:VULN:13053", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:13053", "title": "Web applications security vulnerabilities summary &#40;PHP, ASP, JSP, CGI, Perl&#41;", "type": "securityvulns", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}]}