[Bkis-13-2009] e107 Multiple Vulnerabilities 1. General Information e107 is a free content management system (CMS) written in PHP language and is available at http://e107.org/news.php . In October 2009, Bkis Security discovered a number of XSS and Blind SQL Injection vulnerabilities on this system. Taking advantage of these holes, hackers can insert arbitrary malicious codes onto users' browsers, then steal private information or carry out requests to the website to gain complete control of the website's database. Details: http://blog.bkis.com/e107-multiple-vulnerabilities/ SVRT Advisory: Bkis-13-2009 Initial vendor notification: 10/28/09 Release Date: 11/23/09 Update Date: 11/23/09 Discovered by: Do Hoang Bach, Bkis Attack Type: XSS, SQL Injection Security Rating: High Impact: Code Execution Affected Software: E107 (ver <= 0.7.16) 2. Technical details The found XSS holes reside in the following modules: - submitnews.php - usersettings.php. - e107_admin/newpost.php. - e107_admin/banlist.php. - e107_admin/banner.php. - e107_admin/cpage.php - e107_admin/download.php. - e107_admin/users_extended.php. - e107_admin/frontpage.php. - e107_admin/links.php. - e107_admin/mailout.php. To be specific, the flaws on these modules are results of inadequate check of input variables, allowing hackers to insert scripts onto the links before sending them to e107's users. When users log in to e107 and click on these links, the malicious codes will be executed on their browsers. By this way, hackers can harvest cookies, sessions, etc on the infected machines and, therefore, are able to steal secret information of users. The Blind SQL Injection hole lies in Search function of the website. Exploiting this hole, hackers can carry out any requests to the website and get the complete control of the its database. 3. Solution As these are dangerous vulnerabilities, Bkis has notified e107's developer of the problem. Besides, we recommend that individuals, organizations using e107 be cautious of links from unclear origins, and regularly check for patch on e107's website. -------------- http://blog.bkis.com