exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

secunia-jetbox.txt

secunia-jetbox.txt
Posted Aug 17, 2006
Authored by Sven Krewitt | Site secunia.com

Secunia Research has discovered some vulnerabilities in Jetbox CMS version 2.1 SR1, which can be exploited by malicious people to conduct session fixation attacks, disclose certain system information, conduct cross-site scripting, script insertion, and SQL injection attacks, and compromise a vulnerable system.

tags | advisory, vulnerability, xss, sql injection
advisories | CVE-2006-3583, CVE-2006-3584, CVE-2006-3585, CVE-2006-3586
SHA-256 | 9f04052cf29a6c2a2789c34d885d6c38cca5d32aabb96f773f141859450e1776

secunia-jetbox.txt

Change Mirror Download
====================================================================== 

Secunia Research 02/08/2006

- Jetbox Multiple Vulnerabilities -

======================================================================
Table of Contents

Affected Software....................................................1
Severity.............................................................2
Vendor's Description of Software.....................................3
Description of Vulnerability.........................................4
Solution.............................................................5
Time Table...........................................................6
Credits..............................................................7
References...........................................................8
About Secunia........................................................9
Verification........................................................10

======================================================================
1) Affected Software

Jetbox CMS 2.1 SR1

Other versions may also be affected.

======================================================================
2) Severity

Rating: Highly critical
Impact: System access
Exposure of system information
Manipulation of data
Cross-Site Scripting
Hijacking
Where: From remote

======================================================================
3) Vendor's Description of Software

"Jetbox content management system is seriously tested on usability &
has a professional intuitive interface.".

Product Link:
http://jetbox.streamedge.com/index.php

======================================================================
4) Description of Vulnerability

Secunia Research has discovered some vulnerabilities in Jetbox CMS,
which can be exploited by malicious people to conduct session fixation
attacks, disclose certain system information, conduct cross-site
scripting, script insertion, and SQL injection attacks, and compromise
a vulnerable system.

1) An error in the handling of sessions during login to the
administration section can be exploited to hijack another user's
session by tricking the user into logging in after following a
specially crafted link.

2) Input passed via the URL is not properly sanitised before being
used in a dynamic variable evaluation in index.php. This can be
exploited to overwrite certain configuration variables.

Successful exploitation e.g. leads to disclosure of certain system
information via phpinfo or execution of arbitrary HTML and script code
in a user's browser session in context of an affected site.

3) Input passed to the "login" parameter in admin/cms/index.php is not
properly sanitised before being returned to the user. This can be
exploited to execute arbitrary HTML and script code in a user's
browser session in context of an affected site.

4) Input passed to formmail.php via the "Supply news" page is not
properly sanitised before being returned to the user. This can be
exploited to execute arbitrary HTML and script code in a user's
browser session in context of an affected site.

This is related to:
SA13576

5) Input passed via the URL is not properly sanitised before being
returned in the "Site statistics" page in the administration section.
This can be exploited to insert arbitrary HTML and script code, which
is executed in an administrative user's browser session in context of
an affected site when statistics are viewed.

6) Input passed to the "query_string" form field parameter when
performing a search is not properly sanitised before being used. This
can be exploited to insert arbitrary HTML and script code, which is
executed in an administrative user's browser session in context of an
affected site when search statistics are viewed.

7) Input passed to the "frontsession" cookie parameter, the "view"
parameter in index.php, and to the "login" parameter in
admin/cms/index.php is not properly sanitised before being used in SQL
queries. This can be exploited to manipulate SQL queries by injecting
arbitrary SQL code.

Successful exploitation may lead to execution of arbitrary PHP code by
including files from external resources, but requires that
"magic_quotes_gpc" is disabled.

======================================================================
5) Solution

Use another product.

======================================================================
6) Time Table

14/07/2006 - Initial vendor notification.
21/07/2006 - Second vendor notification.
02/08/2006 - Public disclosure.

======================================================================
7) Credits

Discovered by Sven Krewitt, Secunia Research.

======================================================================
8) References

The Common Vulnerabilities and Exposures (CVE) project has assigned
CVE-2006-3583 (session fixation), CVE-2006-3584 (overwriting
configuration variables), CVE-2006-3585 (cross-site scripting and
script insertion), and CVE-2006-3586 (SQL injection) for the
vulnerabilities.

======================================================================
9) About Secunia

Secunia collects, validates, assesses, and writes advisories regarding
all the latest software vulnerabilities disclosed to the public. These
advisories are gathered in a publicly available database at the
Secunia website:

http://secunia.com/

Secunia offers services to our customers enabling them to receive all
relevant vulnerability information to their specific system
configuration.

Secunia offers a FREE mailing list called Secunia Security Advisories:

http://secunia.com/secunia_security_advisories/

======================================================================
10) Verification

Please verify this advisory by visiting the Secunia website:
http://secunia.com/secunia_research/2006-57/

Complete list of vulnerability reports published by Secunia Research:
http://secunia.com/secunia_research/

======================================================================




Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    0 Files
  • 20
    Mar 20th
    0 Files
  • 21
    Mar 21st
    0 Files
  • 22
    Mar 22nd
    0 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    0 Files
  • 26
    Mar 26th
    0 Files
  • 27
    Mar 27th
    0 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close