[Bkis-13-2009] e107 Multiple Vulnerabilities
1. General Information
e107 is a free content management system (CMS) written in PHP language
and is available at http://e107.org/news.php . In October 2009, Bkis
Security discovered a number of XSS and Blind SQL Injection
vulnerabilities on this system. Taking advantage of these holes, hackers
can insert arbitrary malicious codes onto users' browsers, then steal
private information or carry out requests to the website to gain
complete control of the website's database.
Details: http://blog.bkis.com/e107-multiple-vulnerabilities/
SVRT Advisory: Bkis-13-2009
Initial vendor notification: 10/28/09
Release Date: 11/23/09
Update Date: 11/23/09
Discovered by: Do Hoang Bach, Bkis
Attack Type: XSS, SQL Injection
Security Rating: High
Impact: Code Execution
Affected Software: E107 (ver <= 0.7.16)
2. Technical details
The found XSS holes reside in the following modules:
- submitnews.php
- usersettings.php.
- e107_admin/newpost.php.
- e107_admin/banlist.php.
- e107_admin/banner.php.
- e107_admin/cpage.php
- e107_admin/download.php.
- e107_admin/users_extended.php.
- e107_admin/frontpage.php.
- e107_admin/links.php.
- e107_admin/mailout.php.
To be specific, the flaws on these modules are results of inadequate
check of input variables, allowing hackers to insert scripts onto the
links before sending them to e107's users. When users log in to e107 and
click on these links, the malicious codes will be executed on their
browsers. By this way, hackers can harvest cookies, sessions, etc on
the infected machines and, therefore, are able to steal secret
information of users.
The Blind SQL Injection hole lies in Search function of the website.
Exploiting this hole, hackers can carry out any requests to the website
and get the complete control of the its database.
3. Solution
As these are dangerous vulnerabilities, Bkis has notified e107's
developer of the problem. Besides, we recommend that individuals,
organizations using e107 be cautious of links from unclear origins, and
regularly check for patch on e107's website.
--------------
http://blog.bkis.com