[V]Book Multiple Vulnerabilities

Summary

Vulnerability
[V]Book Multiple Vulnerabilities
Discovered
2006.03.29
Last Update
2006.04.09 Exploitation code published
ID
EV0111
CVE
CVE-2006-1561 CVE-2006-1562 CVE-2006-1563
Risk Level
high
Type
Multiple Vulnerabilities
Status
Unpatched. No reply from developer(s)
Vendor
n/a
Vulnerable Software
[V]Book (http://www.vscripts.pl/?id=vbook2)
Version
2.0
PoC/Exploit
Available
Solution
Not available
Discovered by
Aliaksandr Hartsuyeu (eVuln.com)

Description

Multiple Vulnerabilities found in [V]Book (http://www.vscripts.pl/?id=vbook2) script.

1. SQL Injection.

Vulnerable script: index.php

Parameter x is not properly sanitized before being used in SQL query. This can be used to evaluate arbitrary SQL expression.

Condition: magic_quotes_gpc = off


2. Multiple Cross-Site Scripting.

Vulnerable Script: index.php

Parameters autor, www, temat, tresc are not properly sanitized. This can be used to post arbitrary HTML or web script code.


3. PHP Code Insertion.

Administrator has an ability to edit variable values from config.php file. This can be used to insert arbitrary PHP code into config file which executes by every php-script.

System access is possible.

Condition: magic_quotes_gpc = off

PoC/Exploit

1. SQL Injection Example:

http://[host]/vbook/index.php?x=%' AND [sql_expression]/*


2. Cross-Site Scripting Example:

URL: http://website/vbook/index.php?a=dodaj
www: [XSS]
temat: [XSS]
tresc: [XSS]


3. PHP Code Insertion Example:

URL: http://[host]/vbook/admin.php?a=config
tlo: #BCCBCD"; [php_code] $aa="

Solution.

Solution for "[V]Book Multiple Vulnerabilities" is not available. Check vendor's website for updates.