Title: ====== Dir2web3 Multiple Vulnerabilities Date: ===== 05/08/2012 Author: ======= Daniel Correa (http://www.sinfocol.org/) Vulnerable software: ==================== Dir2web v3.0 (http://www.dir2web.it/) CVE: ==== CVE-2012-4069 CVE-2012-4070 Details: ======== There are two vulnerabilities identified on Dir2web v3.0: Information disclosure (CVE-2012-4069): Database folder is public and it is not protected via .htaccess. An attacker can download the entire database and look for hidden pages on the website. SQL Injection (CVE-2012-4070): Preg_match function is not enough to protect GET/POST parameters. An attacker can easily make a SQL Injection over the application. Exploit: ======== Information disclosure: http://site/_dir2web/system/db/website.db SQL Injection: http://site/index.php?wpid=homepage&oid=6a303a0aaa' OR id > 0-- - Patch: ====== Information disclosure: Create .htaccess file on _dir2web folder with the following content: order deny, follow deny from all SQL Injection: Fix the regular expression in dispatcher.php file located on _dir2web/system/src folder. Replace: '/[a-zA-Z0-9]{10}/' With: '/^[a-zA-Z0-9]{10}$/' Timeline: ========= 13/07/2012: Vendor contacted 25/07/2012: CERT contacted 27/07/2012: CVE assigned 05/08/2012: Vulnerability published on Bugtraq -- Regards, Daniel Correa