Infoproject Biznis Heroj (XSS/SQLi) Multiple Remote Vulnerabilities

2011-12-21T00:00:00
ID ZSL-2011-5064
Type zeroscience
Reporter Gjoko Krstic
Modified 2011-12-21T00:00:00

Description

Title: Infoproject Biznis Heroj (XSS/SQLi) Multiple Remote Vulnerabilities
Advisory ID: ZSL-2011-5064
Type: Local/Remote
Impact: Exposure of System Information, Exposure of Sensitive Information, Manipulation of Data, Cross-Site Scripting
Risk: (3/5)
Release Date: 21.12.2011

Summary

Biznis Heroj or Business Hero (Бизнис Херој) is the first software on the Macedonian market that will help you manage your business processes in your company, such as accounting, production, acquisition, archiving, inventory, and the Cloud. Using the Cloud technology, Biznis Heroj allows you to access the system from any computer at any time through any internet browser.

Description

Input passed via the parameters 'filter' in 'widget.dokumenti_lista.php' and 'fin_nalog_id' in 'nalozi_naslov.php' script are not properly sanitised before being returned to the user or used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. The param 'config' in 'nalozi_naslov.php' and 'widget.dokumenti_lista.php' is vulnerable to a XSS issue where the attacker can execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Vendor

Infoproject DOO - <http://www.biznisheroj.mk>

Affected Version

Plus, Pro and Extra

Tested On

Apache, PHP

Vendor Status

[14.12.2011] Vulnerability discovered.
[15.12.2011] Contact with the vendor.
[20.12.2011] No response from the vendor.
[21.12.2011] Public security advisory released.

PoC

biznish_sqlxss.txt

Credits

Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk>

References

[1] <http://www.exploit-db.com/exploits/18259/>
[2] <http://securityreason.com/exploitalert/11068>
[3] <http://www.securityfocus.com/bid/51151>
[4] <http://packetstormsecurity.org/files/108078/ZSL-2011-5064.txt>
[5] <http://xforce.iss.net/xforce/xfdb/71927>
[6] <http://xforce.iss.net/xforce/xfdb/71928>
[7] <http://cxsecurity.com/issue/WLB-2011120041>
[8] <http://osvdb.org/show/osvdb/78295>
[9] <http://osvdb.org/show/osvdb/78296>
[10] <http://osvdb.org/show/osvdb/78297>
[11] <http://osvdb.org/show/osvdb/78298>
[12] <http://cve.mitre.org/cgi-bin/cvename.cgi?name=2011-5039>
[13] <http://cve.mitre.org/cgi-bin/cvename.cgi?name=2011-5040>

Changelog

[21.12.2011] - Initial release
[22.12.2011] - Added reference [4] and [5]
[24.12.2011] - Added reference [6] and [7]
[15.01.2012] - Added reference [8], [9], [10], [11], [12] and [13]

Contact

Zero Science Lab

Web: <http://www.zeroscience.mk>
e-mail: lab@zeroscience.mk

                                        
                                            &lt;html&gt;&lt;head&gt;&lt;title&gt;403 Nothing to see.&lt;/title&gt;
&lt;link rel="Shortcut Icon" href="favicon.ico" type="image/x-icon"&gt;
&lt;style type="text/css"&gt;
&lt;!--
body {
	background-color: #000;
}
body,td,th {
	font-family: Verdana, Geneva, sans-serif;
}
a:link {
	color: #008FEF;
	text-decoration: none;
}
a:visited {
	color: #008FEF;
	text-decoration: none;
}
a:hover {
	text-decoration: underline;
	color: #666;
}
a:active {
	text-decoration: none;
}
--&gt;
&lt;/style&gt;
&lt;/head&gt;
&lt;body bgcolor=black&gt;
&lt;center&gt;
&lt;font color="#7E88A3" size="2"&gt;
&lt;br /&gt;&lt;br /&gt;
&lt;h1&gt;403 Nothing to see.&lt;/h1&gt;

You do not have the powah for this request /403.shtml&lt;br /&gt;&lt;br /&gt;
&lt;font size="2"&gt;&lt;a href="https://www.zeroscience.mk"&gt;https://www.zeroscience.mk&lt;/a&gt;&lt;/font&gt;
&lt;/font&gt;&lt;/center&gt;
&lt;/body&gt;&lt;/html&gt;