Jaow CMS v2.3 - SQL Injection / XSS Vulnerabilites

Title:
======
Jaow CMS v2.3 - Multiple Web Vulnerabilites

Common Vulnerability Scoring System:
====================================
7.2


Introduction:
=============
Jaow is a CMS that can manage sites of small sizes, thanks to its simple, commented code you 
can easily create templates and / or create modules to suit your needs. Jaow is the solution for 
small sites, blogs or portfolio. Here is the list of features currently available:

* Category Manager
* Section Manager (using TinyMCE)
* Manager menu (adding links)
* Manager template (using Vtemplate)
* File Manager (using Elfinder)
* Manager of partners
* User Manager (Administration access)
* Contact Form
* General Configuration via Back-Office
* Manager Comments
* Maintenance Manager Site
* Backing up the database
* Page Manager
* Statistics Tool
* Notation articles
* Share with social networks (twitter, Facebook)
* Customize error 404
* Generating RSS feeds

(Copy of the Vendor Homepage:  http://fr.wikipedia.org/wiki/Jaow_CMS )

Details:
========
Multiple SQL Injection vulnerabilities  are detected in in Jaow v2.3 Content Management System.
The vulnerability allows an attacker (remote) or local low privileged user account to inject/execute own sql commands 
on the affected application dbms. Successful exploitation of the vulnerability results in dbms & application compromise.

Vulnerable Module(s):
                                               [+] articles.php?modifier_articles=2&page
                                               [+] articles.php?modifier_articles
                                               [+] categories.php?modifier_categories=1&page
                                               [+] categories.php?modifier_categories
                                               [+] pages.php?modifier_pages=1&page
                                               [+] pages.php?modifier_pages
                                               [+] menu.php?modifier_menus=6&page
                                               [+] menu.php?modifier_menus
                                               [+] liens.php?modifier_liens=1&page
                                               [+] liens.php?modifier_liens

Solution:
=========
In file: administration/pages.php
In line 49:

	$Id_selection = $_GET[`modifier_pages`];

we edit:

	$Id_selection = (int)$_GET[`modifier_pages`];

In file: administration/menu.php
In line 48:

	$Id_selection = $_GET[`modifier_menus`];

we edit:

	$Id_selection = (int)$_GET[`modifier_menus`];

In file: administration/liens.php
In line 49:

	$Id_selection = $_GET[`modifier_liens`];

we edit:

	$Id_selection = (int)$_GET[`modifier_liens`];

In file: administration/categories.php
In line 50:

	$Id_selection = $_GET[`id`];

we edit:

	$Id_selection = (int)$_GET[`id`];

In file: administration/articles.php
In line 48:

	$Id_selection = $_GET[`modifier_articles`];

we edit:

	$Id_selection = (int)$_GET[`modifier_articles`];

In file: administration/articles.php
In line 137:

	$start_pages = ($courant - 1) * $nb_results_p_page;

we edit:

	$start_pages = ($courant - 1) * $nb_results_p_page;
                  $start_pages = (int)$start_pages;
                  if($start_pages<0) $start_pages = 0;

In file: administration/categories.php
In line 115:

	$start_pages = ($courant - 1) * $nb_results_p_page;

we edit:

	$start_pages = ($courant - 1) * $nb_results_p_page;
                  $start_pages = (int)$start_pages;
                  if($start_pages<0) $start_pages = 0;

In file: administration/liens.php
In line 105:

	$start_pages = ($courant - 1) * $nb_results_p_page; 

we edit:

	$start_pages = ($courant - 1) * $nb_results_p_page; 
                  $start_pages = (int)$start_pages;
                  if($start_pages<0) $start_pages = 0;

In file: administration/menu.php
In line 103:

	$start_pages = ($courant - 1) * $nb_results_p_page;

we edit:

	$start_pages = ($courant - 1) * $nb_results_p_page;
                  $start_pages = (int)$start_pages;
                  if($start_pages<0) $start_pages = 0;

In file: administration/pages.php
In line 100:

	$start_pages = ($courant - 1) * $nb_results_p_page;

we edit:

	$start_pages = ($courant - 1) * $nb_results_p_page;
                  $start_pages = (int)$start_pages;
                  if($start_pages<0) $start_pages = 0;

In file: administration/statistiques.php
In line 184:

	$start_pages = ($courant - 1) * $nb_results_p_page;

we edit:

	$start_pages = ($courant - 1) * $nb_results_p_page;
                  $start_pages = (int)$start_pages;
                  if($start_pages<0) $start_pages = 0;

In file: administration/utilisateur.php
In line 66:

	$start_pages = ($courant - 1) * $nb_results_p_page;

we edit:

	$start_pages = ($courant - 1) * $nb_results_p_page;
                  $start_pages = (int)$start_pages;
                  if($start_pages<0) $start_pages = 0;

In file: archives.php
In line 65:

	$start_pages = ($courant - 1) * $nb_results_p_page;

we edit:

	$start_pages = ($courant - 1) * $nb_results_p_page;
                  $start_pages = (int)$start_pages;
                  if($start_pages<0) $start_pages = 0;

In file: articles.php
In line 48:

	$start_pages = ($courant - 1) * $nb_results_p_page; 

we edit:

	$start_pages = ($courant - 1) * $nb_results_p_page; 
                  $start_pages = (int)$start_pages;
                  if($start_pages<0) $start_pages = 0;

In file: articles_categories.php
In line 86:

	$start_pages = ($courant - 1) * $nb_results_p_page;

we edit:

	$start_pages = ($courant - 1) * $nb_results_p_page;
                  $start_pages = (int)$start_pages;
                  if($start_pages<0) $start_pages = 0;

In file: liens.php
In line 68:

                 $start_pages = ($courant - 1) * $nb_results_p_page;

we edit:

                 $start_pages = ($courant - 1) * $nb_results_p_page;
                  $start_pages = (int)$start_pages;
                  if($start_pages<0) $start_pages = 0;

XSS:

In file: modules/Commentaires/mod_commentaires.php
49:

	$Pseudo =  addslashes($_POST[`Pseudo`]);

we edit:

	$Pseudo =  htmlentities(addslashes($_POST[`Pseudo`]));

In file: administration/articles.php
In line 105:    
 
	$Titre =  addslashes($_POST[`titre`]);

we edit:

	$Titre =  htmlentities(addslashes($_POST[`titre`]));

In line 107:

	$Sommaire =  addslashes($_POST[`sommaire`]);

we edit:

	$Sommaire =  htmlentities(addslashes($_POST[`sommaire`]));

In line 108:

	$Contenu =  addslashes($_POST[`contenu`]);

we edit:

	$Contenu =  htmlentities(addslashes($_POST[`contenu`]));

In file: administration/categories.php
In line 85:

	$Titre = addslashes($_POST[`titre`]);

we edit:

	$Titre = htmlentities(addslashes($_POST[`titre`]));

In file: administration/pages.php
In line 71:    

	$Titre = addslashes($_POST[`titre`]);

we edit:

	$Titre = htmlentities(addslashes($_POST[`titre`]));

In file: administration/pages.php
In line 72:

	$Contenu =  addslashes($_POST[`contenu`]);

we edit:

	$Contenu =  htmlentities(addslashes($_POST[`contenu`]));

In file: administration/configuration.php
In line 180:

	$Titre = addslashes($_POST[`Titre`]);

we edit:

	$Titre = htmlentities(addslashes($_POST[`Titre`]));

In line 185:

	$Footer = addslashes($_POST[`Footer`]);

we edit:

	$Footer = htmlentities(addslashes($_POST[`Footer`]));

In file: administration/utilisateur.php
In line 57:

	$Pseudo = stripAccents($_POST[`Pseudo`]);

we edit:

	$Pseudo = htmlentities(stripAccents($_POST[`Pseudo`]));


Risk:
=====
1.1
The security risk of the sql injection vulnerability is estimated as medium(+).

1.2
The security risk of the persistent input validation vulnerability is estimated as medium(-).



#  0day.today [2018-02-17]  #