OPENCONF CE 3.41 MULTIPLE XSS AND SQL

====================================================
OPENCONF CE 3.41 MULTIPLE XSS AND SQLI
====================================================

Aplication: OpenConf CE
Version: 3.41
Critical: High
Impact: Steal admin session and database extraction
Websec Advisory: ws10-06

BACKGROUND
=======================
OpenConf is a peer-review management system that greatly facilitates the submission and review processes for conferences, workshops, and symposia. The software is flexible enough that OpenConf is also used for journals, grants, and books.

DESCRIPTION
=======================
It is possible to use Cross-Site Scripting to steal the admin’s session just by having the admin visit a webpage that’s under the attackers control. Futhermore, user input is sent to the database without being sanatized allowing an attacker to send queries to the database.

EXPLOITS / POC
=======================

[0] http://localhost/openconf/chair/show\_reviewer.php?rid=1’ and ‘’=’

[1] http://localhost/openconf/chair/list\_scores.php?s=">

[2] http://localhost/openconf/chair/show\_paper.php?pid=

VULNERABLE CODE AND FIX
=============================

[0] LINE 22 (SQLi) LINE 25 (XSS):
20: $q = “SELECT * FROM “ . OCC_TABLE_REVIEWER . “ WHERE reviewerid=’”.$_GET[‘rid’].“’”;
21: $r = ocsql_query($q) or err(“Unable to get information “.mysql_errno());
22: $l = mysql_fetch_array($r);
23: print ‘
24:

25:

LINE 41:
$tq = “SELECT topicname, short FROM “ . OCC_TABLE_REVIEWERTOPIC . “, “ . OCC_TABLE_TOPIC . “ WHERE reviewerid=’”.$_GET[‘rid’].“’ AND “ . OCC_TABLE_REVIEWERTOPIC . “.topicid=” . OCC_TABLE_TOPIC . “.topicid”;

LINE 54:
$q = “SELECT “ . OCC_TABLE_PAPERADVOCATE . “.paperid, “ . OCC_TABLE_PAPER . “.title FROM “ . OCC_TABLE_PAPERADVOCATE . “, “ . OCC_TABLE_PAPER . “ WHERE “ . OCC_TABLE_PAPERADVOCATE . “.advocateid=’” . $_GET[‘rid’] . “’ AND “ . OCC_TABLE_PAPERADVOCATE . “.paperid=” . OCC_TABLE_PAPER . “.paperid”;

LINE 59:
print ‘• ’ . $l[‘paperid’] . ’. ’ . safeHTMLstr($l[‘title’]) . ‘
’;

LINE 64:
$q = “SELECT “ . OCC_TABLE_PAPERREVIEWER . “.paperid, “ . OCC_TABLE_PAPER . “.title FROM “ . OCC_TABLE_PAPERREVIEWER . “, “ . OCC_TABLE_PAPER . “ WHERE “ . OCC_TABLE_PAPERREVIEWER . “.reviewerid=’” . $_GET[‘rid’] . “’ AND “ . OCC_TABLE_PAPERREVIEWER . “.paperid=” . OCC_TABLE_PAPER . “.paperid”;

LINE 69:
print ‘• ’ . $l[‘paperid’] . ’. ’ . safeHTMLstr($l[‘title’]) . ‘
’;

FIX:
20: $q = “SELECT * FROM “ . OCC_TABLE_REVIEWER . “ WHERE reviewerid=’”.safeSQLstr($_GET[‘rid’]).“’”;
21: $r = ocsql_query($q) or err(“Unable to get information “.mysql_errno());
22: $l = mysql_fetch_array($r);
23: print ‘
24:

ID:	’.$_GET[‘rid’].’

25:

LINE 41:
$tq = “SELECT topicname, short FROM “ . OCC_TABLE_REVIEWERTOPIC . “, “ . OCC_TABLE_TOPIC . “ WHERE reviewerid=’”.safeSQLstr($_GET[‘rid’]).“’ AND “ . OCC_TABLE_REVIEWERTOPIC . “.topicid=” . OCC_TABLE_TOPIC . “.topicid”;

LINE 54:
$q = “SELECT “ . OCC_TABLE_PAPERADVOCATE . “.paperid, “ . OCC_TABLE_PAPER . “.title FROM “ . OCC_TABLE_PAPERADVOCATE . “, “ . OCC_TABLE_PAPER . “ WHERE “ . OCC_TABLE_PAPERADVOCATE . “.advocateid=’” . safeSQLstr($_GET[‘rid’]) . “’ AND “ . OCC_TABLE_PAPERADVOCATE . “.paperid=” . OCC_TABLE_PAPER . “.paperid”;

LINE 59:
print ‘• ’ . $l[‘paperid’] . ’. ’ . safeHTMLstr($l[‘title’]) . ‘
’;

LINE 64:
$q = “SELECT “ . OCC_TABLE_PAPERREVIEWER . “.paperid, “ . OCC_TABLE_PAPER . “.title FROM “ . OCC_TABLE_PAPERREVIEWER . “, “ . OCC_TABLE_PAPER . “ WHERE “ . OCC_TABLE_PAPERREVIEWER . “.reviewerid=’” . safeSQLstr($_GET[‘rid’]) . “’ AND “ . OCC_TABLE_PAPERREVIEWER . “.paperid=” . OCC_TABLE_PAPER . “.paperid”;

LINE 69:
print ‘• ’ . $l[‘paperid’] . ’. ’ . safeHTMLstr($l[‘title’]) . ‘
’;

________________________

[1] FILE: openconf/chair/list_scores.php

LINE 261:
print ‘

FIX:
LINE 261: print ‘

________________________

[2] FILE: openconf/chair/show_paper.php

LINE 117:\

FIX:\

WORKAROUND
=======================

1. Don’t browse untrusted web sites while logged into OpenConf.

2. Apply recommended fixes.

DISCLOSURE TIMELINE
=======================

2009/11/16 - Vulnerability discovered
2009/11/26 - Vendor contacted

REFERENCES
=======================

WebVuln - http://www.webvuln.com\ OpenConf - http://www.openconf.com

ID:	’.safeHTMLstr( $_GET[‘rid’]).’
’ . $usescore . ’	’ . $usescore . ’
ID	' . $\_GET\['pid'\] . '
ID	' . safeHTMLstr($\_GET\['pid'\]) . '

Relacionado

Ejecución de comandos en Zhone GPON-2520 y remote root shell (puerta trasera)

Generador de WPA Huawei HG8245 y HG8247

Ejecución de comandos en Alcatel-Lucent I-240W-Q