====================================================================== Secunia Research 02/08/2006 - Jetbox Multiple Vulnerabilities - ====================================================================== Table of Contents Affected Software....................................................1 Severity.............................................................2 Vendor's Description of Software.....................................3 Description of Vulnerability.........................................4 Solution.............................................................5 Time Table...........................................................6 Credits..............................................................7 References...........................................................8 About Secunia........................................................9 Verification........................................................10 ====================================================================== 1) Affected Software Jetbox CMS 2.1 SR1 Other versions may also be affected. ====================================================================== 2) Severity Rating: Highly critical Impact: System access Exposure of system information Manipulation of data Cross-Site Scripting Hijacking Where: From remote ====================================================================== 3) Vendor's Description of Software "Jetbox content management system is seriously tested on usability & has a professional intuitive interface.". Product Link: http://jetbox.streamedge.com/index.php ====================================================================== 4) Description of Vulnerability Secunia Research has discovered some vulnerabilities in Jetbox CMS, which can be exploited by malicious people to conduct session fixation attacks, disclose certain system information, conduct cross-site scripting, script insertion, and SQL injection attacks, and compromise a vulnerable system. 1) An error in the handling of sessions during login to the administration section can be exploited to hijack another user's session by tricking the user into logging in after following a specially crafted link. 2) Input passed via the URL is not properly sanitised before being used in a dynamic variable evaluation in index.php. This can be exploited to overwrite certain configuration variables. Successful exploitation e.g. leads to disclosure of certain system information via phpinfo or execution of arbitrary HTML and script code in a user's browser session in context of an affected site. 3) Input passed to the "login" parameter in admin/cms/index.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. 4) Input passed to formmail.php via the "Supply news" page is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. This is related to: SA13576 5) Input passed via the URL is not properly sanitised before being returned in the "Site statistics" page in the administration section. This can be exploited to insert arbitrary HTML and script code, which is executed in an administrative user's browser session in context of an affected site when statistics are viewed. 6) Input passed to the "query_string" form field parameter when performing a search is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which is executed in an administrative user's browser session in context of an affected site when search statistics are viewed. 7) Input passed to the "frontsession" cookie parameter, the "view" parameter in index.php, and to the "login" parameter in admin/cms/index.php is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. Successful exploitation may lead to execution of arbitrary PHP code by including files from external resources, but requires that "magic_quotes_gpc" is disabled. ====================================================================== 5) Solution Use another product. ====================================================================== 6) Time Table 14/07/2006 - Initial vendor notification. 21/07/2006 - Second vendor notification. 02/08/2006 - Public disclosure. ====================================================================== 7) Credits Discovered by Sven Krewitt, Secunia Research. ====================================================================== 8) References The Common Vulnerabilities and Exposures (CVE) project has assigned CVE-2006-3583 (session fixation), CVE-2006-3584 (overwriting configuration variables), CVE-2006-3585 (cross-site scripting and script insertion), and CVE-2006-3586 (SQL injection) for the vulnerabilities. ====================================================================== 9) About Secunia Secunia collects, validates, assesses, and writes advisories regarding all the latest software vulnerabilities disclosed to the public. These advisories are gathered in a publicly available database at the Secunia website: http://secunia.com/ Secunia offers services to our customers enabling them to receive all relevant vulnerability information to their specific system configuration. Secunia offers a FREE mailing list called Secunia Security Advisories: http://secunia.com/secunia_security_advisories/ ====================================================================== 10) Verification Please verify this advisory by visiting the Secunia website: http://secunia.com/secunia_research/2006-57/ Complete list of vulnerability reports published by Secunia Research: http://secunia.com/secunia_research/ ======================================================================