Date: Wed, 17 Apr 2013 11:07:06 +0800 From: Doraemon Sk8ers <doraemon.sk8ers@...il.com> To: oss-security@...ts.openwall.com Subject: Fwd: Multiple Vulnerabilities in Simple HRM system v2.3 and below Hi, There is a Blind SQL injection vulnerability and Cookie Integrity Protection Vulnerability in Simple HRM system v2.3 and below. The 2 vulnerabilities had been assigned the CVE identifier CVE-2013-2498 and CVE-2013-2499 respectively. # Vendor Homepage: http://www.simplehrm.com/ # Software Link: http://sourceforge.net/projects/simplehrm/ # Version: 2.2/2.3 # Tested on: 2.2 & 2.3 # CVE : CVE-2013-2498, CVE-2013-2499 Details: ----------- * * *CVE-2013-2498* Simple HRM system is vulnerable to sqli attacks in their login page. Carefully crafted requests can use the scope to inject arbitrary SQLthrough the login form and obtain information such as password hash. *Attack URL:* http://localhost/simplehrm/index.php/user/setLogin *Method:* POST *Vuln Parameter: *username=*(SQL INJECTION)*&password=abcdef *Vuln Type*: unsanitised input argument *($name)* in *Vuln **File:* simlehrm/flexycms/modules/user/user_manager.php *Line:* 84 $res_company = getsingleindexrow('CALL get_search_sql("'.TABLE_PREFIX.'company","email_id = \''.$name.'\' AND isactive = 1 LIMIT 1")'); *CVE-2013-2499* We discovered that if an attacker were to grab hold of the user's password hash, the attacker can easily spoof a cookie and impersonate as anyone to access the system. Together with the blind sql injection stated above, an attacker can simply blind the password hash, userid, username and recreate a cookie. *Vuln **File:* simlehrm/flexycms/modules/user/user_manager.php *Line:* 215 $v_user_password = md5($info['id_user'].$info['username'].$info['password']); This vuln effectively defeats one of the primary purposes of password hashing. * * Timeline: ------------- Date Discovered: 07 March 2013 Vendor notified: 12 march 2013 Advisory posted: 12 April 2013 (No response from Vendor, published) Regards Team Doraemon.Sk8ers
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.