SaltOS v3.0 r3311 - SQL Injection & File Include Vulnerability

Document Title:
===============
SaltOS v3.0 r3311 - SQL Injection & File Include Vulnerability



Release Date:
=============
2011-08-13


Vulnerability Laboratory ID (VL-ID):
====================================
247


Product & Service Introduction:
===============================
SaltOS is a eGroupware Business Management solution. It integrates features like CRM (Customer Relation Management) 
and ERP (Enterprise Resource Planning). Moreover is it licensed as 100% free software GPL-3.0.

Features:
Efficiency: SaltOS allows you to work in a dynamic and fast way. Moreover you will be able to consult, seek, and 
filter the information in an easy way.
Centralised: SaltOS integrates commercial management, accounting and project management in only one application. 
It also includes every day work tools as e-mail, agenda and document manager.
Accessibility: the only thing you need to work with SaltOS is a computer with internet and / or intranet access. 
SaltOS is a web application that can be accessed via any modern navigator (Google Chrome, Firefox and 
Internet Explorer 7 or higher)
Easy to use: if you are reading this, you can start working with SaltOS right now. You will see it is as easy as 
navigating the Internet.
Scalability: SaltOS doesn’t need powerful servers nor special hardware. The necessary machinery can be installed 
at your personal lap top or even at a high performing server. It is easy to migrate SaltOS from one system to 
another, according your company needs.
Personalised: SaltOS can be personalised according your wishes, from the interface colours till adapting to your 
business needs and even being integrated with already existing solutions (back office).
Extendible: SaltOS is not a closed nor static solution, it can be extended, modified and improved at any moment.
Cost: you don’t have to pay royalties nor licences for using SaltOS. This cost saving enables you to invert money in 
improvements that will make SaltOS your personal solution.
Safe: your data will be transferred encrypted which protects it from being seen by others. Once the data is stored, 
it will be protected by your Company s Operating System and Infrastructure.
The liberty to choose your own provider: SaltOS is licensed by GPL-3, which allows you to choose the provider of 
your own choice.

(Copy of the Vendor Website: http://www.saltos.net/portal/es/saltos.htm)


Abstract Advisory Information:
==============================
The Vulnerability-Lab Team discovered a remote SQL Injection & a local File Include vulnerability on the SaltOS v3.0-r3311 CMS.


Vulnerability Disclosure Timeline:
==================================
2011-08-13: Discovery by Vulnerability-Lab


Discovery Status:
=================
Published


Affected Product(s):
====================

Exploitation Technique:
=======================
Remote


Severity Level:
===============
High


Technical Details & Description:
================================
A remote SQL Injection vulnerability is detected on the new SaltOS v3.0-r3311 Content Management System.
The vulnerability allows an attacker to inject/execute own sql statements to compromise the application dbms.


Vulnerable Module(s):
								[+] Periodicas - ID


--- SQL Error Logs ---
SELECT action_title FROM ( SELECT CONCAT(  link:periodicas(  ,-id,  ):  ,LPAD(id,5,0)) id2, CASE id_cliente WHEN   0  
 THEN   [No associated client]   ELSE CONCAT(  link:clientes(  ,-id_cliente,  ):  ,cliente) END cliente, CASE id_cliente
 WHEN   0   THEN   [No associated client]   ELSE cliente END cliente2, dia, CONCAT( CASE SUBSTR(meses,1,1) WHEN   1   
THEN   Jan    ELSE      END, CASE SUBSTR(meses,2,1) WHEN   1   THEN   Feb    ELSE      END, CASE SUBSTR(meses,3,1) WHEN   1   
THEN   Mar    ELSE      END, CASE SUBSTR(meses,4,1) WHEN   1   THEN   Apr    ELSE      END, CASE SUBSTR(meses,5,1) WHEN   1   
THEN   May    ELSE      END, CASE SUBSTR(meses,6,1) WHEN   1   THEN   Jun    ELSE      END, CASE SUBSTR(meses,7,1) WHEN   1   
THEN   Jul    ELSE      END, CASE SUBSTR(meses,8,1) WHEN   1   THEN   Aug    ELSE      END, CASE SUBSTR(meses,9,1) WHEN   1   
THEN   Sep    ELSE      END, CASE SUBSTR(meses,10,1) WHEN   1   THEN   Oct    ELSE      END, CASE SUBSTR(meses,11,1) WHEN   1   
THEN   Nov    ELSE      END, CASE SUBSTR(meses,12,1) WHEN   1   THEN   Dec    ELSE      END) meses, base,ROUND(base+iva2-irpf2,2) 
total, CASE id_cuenta WHEN   0   THEN   [No account]   ELSE cuenta END cuenta, conceptos, (SELECT COUNT(*) FROM tbl_periodicas_v
 v WHERE v.id_periodica=d.id) vencimientos, id action_id, CONCAT(LPAD(id,5,0),   -   ,cliente) action_title, CASE (1) WHEN 
1 THEN   true   ELSE   false   END action_view, CASE (1) WHEN 1 THEN   true   ELSE   false   END action_edit, CASE 1 AND ((1) 
OR (1)) WHEN 1 THEN   true   ELSE   false   END action_copy, CASE (1) OR (1) WHEN 1 THEN   true   ELSE   false   END action_home, 
CASE (1) WHEN 1 THEN   true   ELSE   false   END action_delete FROM (SELECT c.*,ROUND(base*iva/100.0,2) iva2,ROUND(base*irpf/100.0,2) 
irpf2 FROM (SELECT a.*, ROUND(SUM(precio*unidades*(100.0-descuento)/100.0),2) base, COUNT(b.id) conceptos, e.id_usuario 
id_usuario,e.id_grupo id_grupo,j.nombre cuenta,IFNULL(l.nombre,    ) cliente FROM tbl_periodicas a LEFT JOIN tbl_cuentas j 
ON a.id_cuenta=j.id LEFT JOIN tbl_clientes l ON a.id_cliente=l.id LEFT JOIN tbl_periodicas_c b ON a.id=b.id_periodica LEFT 
JOIN tbl_registros e ON e.id=(SELECT MIN(id) FROM tbl_registros WHERE id_aplicacion=  29   AND id_registro=a.id) GROUP BY a.id) 
c) d WHERE action_id IN (1) ORDER BY id desc) tbl_listsim


Pictures:
								../1.png


1.2
A local File Include vulnerability is detected on the new SaltOS v3.0-r3311 Content Management System.
The vulnerability allows an attacker to request local directory cms & configuration files.

Vulnerable Module(s):
								[+] ?x&files=


Pictures:
								../2.png


Proof of Concept (PoC):
=======================
The vulnerabilities can be exploited by remote attackers & local low privileged user accounts. For demonstration or reproduce ...

1.1  PoC
http://www.vulnerability-lab.com/saltos/user/xml.php?page=periodicas&action=form&id=[SQL-Injection!]&order=id+desc&limit=50
&offset=0&id_cliente=&id_cuenta=&dia1=&dia2=&meses=&filter=&savedfilters=&newfilter=


1.2
http://www.vulnerability-lab.com/saltos/user/xml.php?action=cache&files[FILE-INCLUDE!].php&r=3311


Security Risk:
==============
The security risk of the sql injection vulnerability is estimated as high.
The security risk if the local file include vulnerability is estimated as medium.


Credits & Authors:
==================
Vulnerability Research Laboratory


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties, 
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business 
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some 
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation 
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases 
or trade with fraud/stolen material.

Domains:    www.vulnerability-lab.com   	- www.vuln-lab.com			       - www.vulnerability-lab.com/register
Contact:    [email protected] 	- [email protected] 	       - [email protected]
Section:    video.vulnerability-lab.com 	- forum.vulnerability-lab.com 		       - news.vulnerability-lab.com
Social:	    twitter.com/#!/vuln_lab 		- facebook.com/VulnerabilityLab 	       - youtube.com/user/vulnerability0lab
Feeds:	    vulnerability-lab.com/rss/rss.php	- vulnerability-lab.com/rss/rss_upcoming.php   - vulnerability-lab.com/rss/rss_news.php

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. 
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other 
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and 
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), 
modify, use or edit our material contact ([email protected] or [email protected]) to get a permission.

    				   	Copyright © 2012 | Vulnerability Laboratory