Recent content on Karma(In)Security
Dust off your dial-up modem and fire up your favorite IRC client — today, we’re boarding a time machine straight into the golden era of web forums. About a decade ago, somewhere between the rise of jQuery and the fall of Flash, vBulletin 4.x was king. It powered countless online communities, from gaming clans to enterprise tech support boards. And like many kings of old, it had its share of…
vBulletin is one of the most widely used commercial forum solutions over the Internet, powering thousands of online communities ranging from niche hobbyist sites to large-scale tech forums. Developed primarily in PHP, it features a custom MVC-like framework and a proprietary API system designed to handle AJAX and mobile app interactions. Over the years, vBulletin has gained a reputation for both…
Kerio Control, formerly known as Kerio WinRoute Firewall, is nowadays quite a popular firewall and Unified Threat Management (UTM) product owned and developed by GFI Software: according to Censys, at the moment there are around twenty thousands Kerio Control instances across the Internet! Kerio Control can be considered a network security solution that manages security services such as intrusion…
Artifactory, developed by JFrog, is an industry-leading software repository manager, a single solution for storing and managing all the artifacts, binaries, packages, files, containers, and components for use throughout the software supply chain. JFrog Artifactory serves as a central hub for DevOps, integrating with software development tools and processes. In this blog post I’m going to…
vBulletin is one of the most popular proprietary forum solutions over the Internet. It is used by some major websites, and according to the BuildWith website, vBulletin currently ranks at the second place on the Forum Software Usage Distribution in the Top 1 Million Sites, with over 2.000 websites using it among the “top 1 million”. vBulletin is also known for some famous 0-day Remote Code…
According to the official website ImpressCMS is an open source Content Management System (CMS) designed to easily and securely manage multilingual web sites. With this tool maintaining the content of a website becomes as easy as writing a word document. ImpressCMS is the ideal tool for a wide range of users: from business to community users, from large enterprises to people who want a simple, easy…
SugarCRM is a pretty popular Customer Relationship Management (CRM) application written in PHP code. It was born in 2004 as an open source project hosted on SourceForge, a development repository for free software. By June of the same year, the rapid success of the project allowed the original developers to found SugarCRM Inc. and raise $2 million in venture capital. A month later, on July 3, Sugar…
Magento, which was acquired by Ebay Inc back in 2011, is one of the most popular e-commerce platforms written in PHP. There is an interesting bug bounty program in place that offers bounties of up to 10,000$ for Information Disclosure and Remote Code Execution vulnerabilities. In November 2014, I decided to give it a try, so I started looking for security bugs in Magento CE, and almost immediately…
Just a year ago I had the pleasure to talk about the PHP Object Injection vulnerabilities I discovered in Joomla at the JoomlaDay Italy 2013 held in Naples, one of the most beautiful cities I have ever seen. Today I would like to share with you my experience at that day and some further details about the disclosure process I had with the Joomla! Security Strike Team (JSST).Before that, I would…
Welcome to my third blog post ever, the first in this new year, but still talking about an old friend of mine. Yes, 2014 is here, however the topic is always the same: PHP Object Injection! Perhaps those few people who read my blog are wondering if I will ever write about something else, or whether this is going to be a monothematic blog… Well, who knows?! It could be, or maybe not, but the point…
Last week I have disclosed KIS-2013-04, another PHP Object Injection vulnerability which affects the Joomla CMS. I had initially reported this vulnerability to the Joomla Security Strike Team in December last year, within an e-mail reply about the KIS-2013-03 vulnerability: “Furthermore, I would suggest you to investigate other potentially vulnerable unserialize() calls, for example the…
Today I have disclosed KIS-2013-03, a PHP Object Injection vulnerability which affects the Joomla CMS. I have reported this vulnerability to the Joomla Security Strike Team only some months ago, but to be honest I have noticed that vulnerable unserialize() call a long time before. The only one reason why I have not notified them before is because I thought that it wasn’t exploitable: I had not…
• Software Link: https://www.1c-bitrix.ru • Affected Versions: Version 25.100.500 and prior versions. • Vulnerability Description: The vulnerability is located within the “Translate Module”, which allows users to upload and extract archive files into a temporary directory. However, the application fails to properly verify the contents of these archives before extracting them. This can…
My name is Egidio Romano and I’m also known as "EgiX", which is the nickname I chose when I was fifteen. I got a BS in Computer Science at the University of Catania, Italy. I am passionate about computer security, and addicted to web application security. After gaining solid experience in the IT security industry, I decided to bet on myself and go solo. So, I currently work as a freelance IT…
Description: Unrestricted file upload in the mcpuk file editor (atk/attributes/fck/editor/filemanager/browser/mcpuk/connectors/php/config.php) in Achievo 1.2.0 through 1.3.2 allows remote attackers to execute arbitrary code by uploading a file with .php followed by a safe extension, then accessing it via a direct request to the file in the Achievo root directory. NOTE: this is only a vulnerability…
Description: Static code injection vulnerability in inc/function.base.php in Ajax File and Image Manager before 1.1, as used in tinymce before 1.4.2, phpMyFAQ 2.6 before 2.6.19 and 2.7 before 2.7.1, and possibly other products, allows remote attackers to inject arbitrary PHP code into data.php via crafted parameters. References: CVE-2011-4825 BID-50523 EDB-18085 Disclosure Date: November 5, 2011
Description: Static code injection vulnerability in inc/function.base.php in Ajax File and Image Manager before 1.1, as used in tinymce before 1.4.2, phpMyFAQ 2.6 before 2.6.19 and 2.7 before 2.7.1, and possibly other products, allows remote attackers to inject arbitrary PHP code into data.php via crafted parameters. References: CVE-2011-4825 BID-50523 EDB-18075 Disclosure Date: November 4, 2011
Description: appRain contains a flaw that allows a remote user to execute arbitrary PHP code. This flaw exists because the application uses the uploadify.php script, which does not properly verify or sanitize user-uploaded files. References: CVE-2012-1153 BID-51576 EDB-18392 Disclosure Date: January 19, 2012
• Software Link: http://www.atutor.ca • Affected Versions: Version 2.2 and prior versions. • Vulnerability Description: The vulnerable code is located in the /confirm.php script: 140if (isset($_REQUEST['auto_login'])) 141{ 142 143 $sql = 'SELECT M.member_id, M.login, M.preferences, M.language FROM %smembers M WHERE M.member_id=%d'; 144 $row = queryDB($sql, array(TABLE_PREFIX,…
• Software Link: http://www.atutor.ca • Affected Versions: Version 2.2 and prior versions. • Vulnerability Description: User input passed through the “customicon” parameter when creating a new course is not properly sanitized before being uploaded into the /content/ directory. This could be exploited to upload and execute arbitrary PHP code. Successful exploitation of this…
• Software Link: http://www.atutor.ca • Affected Versions: Version 2.2 and prior versions. • Vulnerability Description: The vulnerable code is located in the /mods/_standard/gradebook/edit_marks.php script: 54if (isset($_GET['asc'])) 55{ 56 $order = 'asc'; 57 $order_col = $addslashes($_GET['asc']); 58} 59else if (isset($_GET['desc'])) { 60 $order = 'desc'; 61 $order_col =…
• Software Link: http://www.atutor.ca • Affected Versions: Version 2.2 and prior versions. • Vulnerability Description: The vulnerable code is located in the /popuphelp.php script: 26if ($_GET['h']) { 27 $h = $_GET['h']; 28 29 if (is_string($_GET['h'])) { // just a AT_HELP code with no prefix 30 $msg->printHelps($h); User input passed through the “h” GET parameter is not properly…
• Software Link: https://www.bitrix24.com • Affected Versions: Version 25.100.300 and prior versions. • Vulnerability Description: The vulnerability is located within the “Translate Module”, which allows users to upload and extract archive files into a temporary directory. However, the application fails to properly verify the contents of these archives before extracting them. This can…
• Software Link: https://cacti.net • Affected Versions: Version 1.2.26 and prior versions. • Vulnerability Description: The vulnerability is located within the import_package() function defined into the /lib/import.php script. This function blindly trusts the filename and file content provided within the uploaded XML data, and writes such files into the Cacti base path (or even outside, since Path…
• Software Link: http://cakephp.org • Affected Versions: Version 3.2.0 RC1 and prior 3.x versions. Version 2.8.0 RC1 and prior 2.x versions. • Vulnerability Description: CakePHP provides some built-in security features including CSRF and Form Tampering protection. Under certain circumstances it might be possible to bypass such security checks, since they are performed only when the HTTP request is…
Description: CMS from Scratch contains a flaw that allows a remote user to execute arbitrary PHP code. The vulnerability is caused due to an error in the handling of file uploads in the cms/FCKeditor/editor/filemanager/connectors/php/upload.php script, when a file name has multiple file extensions. This can be exploited to upload malicious PHP scripts. References: BID-29431 EDB-5691 Disclosure…
Description: CMS Made Simple contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the ‘modules/TinyMCE/content_css.php’ script not properly sanitizing user-supplied input to the ‘templateid’ parameter. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or…
Description: Incomplete blacklist vulnerability in javaUpload.php in Postlet in the FileManager module in CMS Made Simple 1.2.4 and earlier allows remote attackers to execute arbitrary code by uploading a file with a name ending in (1) .jsp, (2) .php3, (3) .cgi, (4) .dhtml, (5) .phtml, (6) .php5, or (7) .jar, then accessing it via a direct request to the file in modules/FileManager/postlet/.…
• Software Link: https://www.concrete5.org • Affected Versions: Version 5.7.3.1 and probably other versions. • Vulnerability Description: The vulnerable code is located within the Application::dispatch() method: 326public function dispatch(Request $request) 327{ 328 if ($this->installed) { 329 $response = $this->getEarlyDispatchResponse(); 330 } 331 if (!isset($response)) { 332 $collection =…
• Software Link: https://www.concrete5.org • Affected Versions: Version 5.7.3.1 and probably other versions. • Vulnerability Description: The vulnerable code is located in /concrete/controllers/single_page/dashboard/system/registration/open.php: 21switch ($this->post('registration_type')) { 22 case 'enabled': 23 Config::save('concrete.user.registration.enabled', true); 24…
• Software Link: https://www.concrete5.org • Affected Versions: Version 5.7.3.1 and probably other versions. • Vulnerabilities Description: Concrete5 implements a Synchronizer Token Pattern in order to provide anti-CSRF capabilities. However, the application fails to properly use this feature in every block or dashboard page which makes a system state change, such as settings modification. As a…
• Software Link: https://www.concrete5.org • Affected Versions: Version 5.7.3.1 and probably other versions. • Vulnerabilities Description: The vulnerable code is located in /concrete/views/panels/details/page/versions.php: 5<? foreach($_REQUEST['cvID'] as $cvID) { 6$tabs[] = array('view-version-' . $cvID, t('Version %s', $cvID), $checked); 7$checked = false; 8} 9print $ih->tabs($tabs);…
• Software Link: https://www.concrete5.org • Affected Versions: Version 5.7.3.1 and probably other versions. • Vulnerabilities Description: User input passed through the “uEmail” and “uDefaultLanguage” POST parameters when registering a new account is not properly sanitized before being used to generate HTML output. This can be exploited by unauthenticated attackers to…
• Software Link: https://www.concrete5.org • Affected Versions: Version 5.7.3.1, 5.7.4, and probably other versions. • Vulnerability Description: The vulnerable code is located in /concrete/src/Permission/Access/Access.php: 168protected function buildAssignmentFilterString($accessType, $filterEntities) 169{ 170 $peIDs = ''; 171 $filters = array(); 172 if (count($filterEntities) > 0) { 173 foreach…
• Software Link: https://www.concrete5.org • Affected Versions: Version 8.5.5 and prior versions. • Vulnerability Description: The vulnerable code is located within the /concrete/controllers/single_page/dashboard/system/environment/logging.php script. Specifically, into the Logging::update_logging() method: 61public function update_logging() 62{ 63 $config = $this->app->make('config'); 64 $request…
• Software Link: https://control-webpanel.com • Affected Versions: Version 0.9.8.1208 and prior versions. • Vulnerability Description: User input passed via the “key” GET parameter to /admin/index.php (when the “api” parameter is set) is not properly sanitized before being used to execute OS commands. This can be exploited by unauthenticated attackers to inject and execute…
Description: Directory traversal vulnerability in the user_get_profile function in include/functions.inc.php in Coppermine Photo Gallery (CPG) 1.4.18 and earlier, when the charset is utf-8, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang part of serialized data in an _data cookie. References: CVE-2008-3486 BID-30480 EDB-6178 Disclosure Date: July…
Description: themes/sample/theme.php in Coppermine Photo Gallery (CPG) 1.4.18 and earlier allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message. References: CVE-2008-3481 EDB-6178 Disclosure Date: July 31, 2008
• Software Link: https://craftercms.org • Affected Versions: Version 4.0.2 and prior versions. Version 3.1.27 and prior versions. • Vulnerabilities Description: There are multiple Reflected Cross-Site Scripting vulnerabilities affecting CrafterCMS. The vulnerabilities exist in every API endpoint that reflect some input parameter and do produce XML responses. Following are some examples:…
• Software Link: http://www.cubecart.com • Affected Versions: All versions from 5.0.0 to 5.2.0. • Vulnerability Description: The vulnerable code is located in the Cubecart::_basket() method defined in the /classes/cubecart.class.php script: 519// Update shipping values 520if (isset($_POST['shipping']) && !empty($_POST['shipping'])) { 521 $GLOBALS['cart']->set('shipping',…
• Software Link: http://dleviet.com • Affected Version: 9.7 only. • Vulnerability Description: The vulnerable code is located in the /engine/preview.php script: 246$c_list = implode (',', $_REQUEST['catlist']); 247 248if( strpos( $tpl->copy_template, '[catlist=' ) !== false ) { 249 $tpl->copy_template = preg_replace( '#\\[catlist=(.+?)\\](.*?)\\[/catlist\\]#ies', 'check_category('\\1', '\\2',…
Description: Static code injection vulnerability in admincp.php in DeluxeBB 1.2 and earlier allows remote authenticated administrators to inject arbitrary PHP code into logs/cp.php via the URI. References: CVE-2008-2195 BID-29062 EDB-5550 Disclosure Date: May 5, 2008
Description: DeluxeBB contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the ‘forums.php’ script not properly sanitizing user-supplied input to the ‘sort’ variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database. References: CVE-2008-2194 BID-29062 EDB-5550 Disclosure Date: May 5,…
Description: SQL injection vulnerability in the autoDetectRegion() function in doceboCore/lib/lib.regset.php in Docebo 3.5.0.3 and earlier allows remote attackers to execute arbitrary SQL commands via the Accept-Language HTTP header. NOTE: this can be leveraged to execute arbitrary PHP code using the INTO DUMPFILE command. References: CVE-2008-7153 BID-27211 EDB-4879 Disclosure Date: January 9,…
Description: Docebo 3.5.0.3 and earlier allows remote attackers to obtain sensitive information via a direct request to (1) class/class.conf_fw.php, (2) class.module/class.event_manager.php, (3) lib/lib.domxml5.php, or (4) menu/menu_over.php in doceboCore/; or (5) class/class.conf_cms.php, (6) lib/lib.compose.php, (7) modules/chat/teleskill.php, or (8) class/class.admin_menu_cms.php in doceboCms/;…
• Software Link: https://docsify.js.org • Affected Versions: Version 4.12.0 and prior versions. • Vulnerability Description: The vulnerability exists due to an incomplete fix for CVE-2020-7680. When parsing HTML from remote URLs, the HTML code on the main page is sanitized, but this sanitization is not taking place in the sidebar. This can be exploited to inject arbitrary HTML code and carry out…
Description: Dokeos contains a flaw that may allow a malicious user to execute arbitrary PHP code. The issue is due to user-supplied input passed via the ‘tablename_column’ parameter to the whoisonline.php script is not properly sanitized before being used in a call to the create_function() PHP function in the main/inc/lib/tablesort.lib.php script. References: BID-34633 EDB-8499…
Description: Dolphin contains a flaw which allows a remote attacker to inject and execute arbitrary PHP code. The issue is due to user-supplied input passed through the ‘bubbles’ parameter to the member_menu_queries.php script isn’t properly sanitized before being used in a call to the eval() PHP function. References: BID-50185 EDB-17994 Disclosure Date: October 18, 2011
• Software Link: http://dotclear.org • Affected Versions: Version 2.6.2 and probably prior versions. • Vulnerability Description: The vulnerable code is located in /admin/categories.php: 70# Update order 71if (!empty($_POST['save_order']) && !empty($_POST['categories_order'])) { 72 $categories = json_decode($_POST['categories_order']); 73 74 foreach ($categories as $category) { 75 if…
• Software Link: http://dotclear.org • Affected Versions: Version 2.6.2 and probably prior versions. • Vulnerability Description: The vulnerability exists because of the filemanager::isFileExclude() method not properly verifying the extension of uploaded files. This method just checks whether the uploaded file name matches the “exclude_pattern” regular expression, which by default is…