Falt4 CMS RC4 10.9.2007 Multiple Remote Vulnerabilities

🗓️ 11 Dec 2007 00:00:00Reported by RootType
Falt4 CMS RC4 10.9.2007 Multiple Remote Vulnerabilities, XSS and Blind SQL Injection, Solution Release

                                                &nbsp;&nbsp;&nbsp;&nbsp;H&nbsp;-&nbsp;Security&nbsp;Labs
&nbsp;&nbsp;&nbsp;&nbsp;Falt4&nbsp;CMS&nbsp;(RC4&nbsp;10.9.2007)&nbsp;Security&nbsp;Report&nbsp;/Advisory
&nbsp;&nbsp;&nbsp;&nbsp;ID&nbsp;:&nbsp;HSEC#20071012

General&nbsp;Information
--------------------------
Name&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;Falt4Extreme&nbsp;CMS&nbsp;(RC4&nbsp;10.9.2007)
Vendor&nbsp;HomePage&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:http://sourceforge.net/projects/falt4/
Platforms&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;PHP&nbsp;&amp;&amp;&nbsp;MySQL
Vulnerability&nbsp;Type&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;Input&nbsp;Validation&nbsp;Errors
Disclosure&nbsp;Timeline
-------------------------
04&nbsp;December&nbsp;&nbsp;2007&nbsp;&nbsp;--&nbsp;Vendor&nbsp;Contacted&nbsp;
04&nbsp;December&nbsp;&nbsp;2007&nbsp;&nbsp;--&nbsp;Vendor&nbsp;Replied
05&nbsp;December&nbsp;&nbsp;2007&nbsp;&nbsp;--&nbsp;Fix&nbsp;Released&nbsp;
10&nbsp;December&nbsp;&nbsp;2007&nbsp;&nbsp;--&nbsp;Pulic&nbsp;Disclosure

What&nbsp;is&nbsp;Falt4Extreme
------------------------
Falt4&nbsp;CMS&nbsp;is&nbsp;a&nbsp;business&nbsp;approved&nbsp;Content&nbsp;Management&nbsp;System&nbsp;(CMS)&nbsp;under&nbsp;the&nbsp;LGPL.&nbsp;The&nbsp;CMS&nbsp;is&nbsp;feature-rich&nbsp;and&nbsp;has&nbsp;a&nbsp;clean&nbsp;administration&nbsp;area.&nbsp;The&nbsp;ultimate&nbsp;CMS&nbsp;with&nbsp;functions&nbsp;for&nbsp;the&nbsp;professional,&nbsp;usable&nbsp;by&nbsp;everyone.CMS&nbsp;modules&nbsp;are&nbsp;available.
Overview&nbsp;of&nbsp;Vulnerabilities
------------------------
The&nbsp;script&nbsp;is&nbsp;vulnerable&nbsp;to&nbsp;both&nbsp;of&nbsp;XSS&nbsp;and&nbsp;Blind&nbsp;SQL&nbsp;Injection&nbsp;attacks.
Details&nbsp;of&nbsp;Vulnerabilities
------------------------
1-Blind&nbsp;SQL&nbsp;Injection&nbsp;Vulnerability:
http://www.EXAMPLE.com/falt4/
index.php?handler=cat&amp;nav_ID=1'%20and%20'1'='1
nav_ID&nbsp;parameter&nbsp;is&nbsp;not&nbsp;sanitized&nbsp;properly&nbsp;and&nbsp;can&nbsp;be&nbsp;used&nbsp;for&nbsp;Blind&nbsp;SQL&nbsp;Injection&nbsp;attacks.
2-Cross&nbsp;Site&nbsp;Scripting&nbsp;Vulnerabilities
i.http://www.EXAMPLE.com/falt4/
index.php?handler=&gt;&quot;&gt;&lt;script&gt;alert(3)&lt;/script&gt;&amp;nav_ID=1
Input&nbsp;passed&nbsp;to&nbsp;the&nbsp;'handler'&nbsp;parameter&nbsp;is&nbsp;not&nbsp;sanitized&nbsp;properly&nbsp;before&nbsp;using&nbsp;and&nbsp;can&nbsp;be&nbsp;used&nbsp;by&nbsp;malicious&nbsp;people&nbsp;to&nbsp;perform&nbsp;XSS&nbsp;attacks.
ii&nbsp;.http://www.EXAMPLE.com/falt4/
modules/feed/feed.php?type=rss&amp;lang=1&amp;topic=&gt;&quot;&gt;&lt;script&gt;alert(2)&lt;/script&gt;
Input&nbsp;passed&nbsp;to&nbsp;the&nbsp;'topic'&nbsp;parameter&nbsp;is&nbsp;not&nbsp;sanitized&nbsp;properly&nbsp;before&nbsp;using&nbsp;and&nbsp;can&nbsp;be&nbsp;used&nbsp;by&nbsp;malicious&nbsp;people&nbsp;to&nbsp;perform&nbsp;XSS&nbsp;attacks.
Solution
-----------------------
Re-download&nbsp;falt4&nbsp;from&nbsp;sourceforge:
http://downloads.sourceforge.net/falt4/falt4extreme.zip?use_mirror=osdn
Replace&nbsp;these&nbsp;files:
/yourfalt4/index.php
/yourfalt4/modules/feed.php
/yourfalt4/admin/index.php
-----------------------
The&nbsp;vulnerabilities&nbsp;found&nbsp;on&nbsp;04&nbsp;December&nbsp;2007
by&nbsp;Mesut&nbsp;Timur&nbsp;&lt;[email protected]&gt;
H&nbsp;-&nbsp;Security&nbsp;Labs&nbsp;,&nbsp;http://www.h-labs.org
Gebze&nbsp;Institue&nbsp;of&nbsp;Technology,&nbsp;Computer&nbsp;Engineering,&nbsp;http://www.gyte.edu.tr
References
-----------------------
Vendor&nbsp;Confirmation&nbsp;:&nbsp;http://sourceforge.net/forum/forum.php?forum_id=762931
Original&nbsp;Advisory&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;http://www.h-labs.org/blog/2007/12/05/falt4_cms_security_report_advisory.html
http://sourceforge.net/projects/falt4/
http://www.h-labs.org
11 Dec 2007 00:00Current
7.1High risk
Vulners AI Score7.1