[Full-disclosure] MHL-2006-001 Public Advisory: "Eazy Cart" Multiple Security Issues
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 MHL-2006-001 - Public Advisory +---+ |Eazy Cart Multiple Security Issues | +---+ PUBLISHED ON October 9th, 2006 PUBLISHED AT http://www.mayhemiclabs.com/advisories/MHL-2006-01.txt http://www.mayhemiclabs.com/wiki/wikka.php?wakka=MHL2006001 PUBLISHED BY Mayhemic Labs http://www.mayhemiclabs.com security AT mayhemiclabs DOT com GPG key: 0x56143F84 APPLICATION Eazy Cart http://www.eazycart.com/ "Eazy Cart the easy to install shopping cart system" AFFECTED VERSIONS All Verison ISSUES Eazy Cart is vulnerable to authenication bypassing, data injection, and XSS attacks 1) Authenication bypass Eazy Cart does not check login credentials past the initial login screen of the administration menu. Example: An attacker can access all administrative functions without authentication by going to /admin/home/index.php. 2) Data Injection Eazy Cart trusts user entered data implicitly, allowing an attacker to adjust prices and other values when ordering. Example: A user can craft a malicious URL to submit incorrect data to easycart.php telling it to add items to its cart for incorrect prices, including negative values. 3) XSS Eazy Cart trusts user entered data implicitly, not sanatizing it for malicious code. Example: A user can craft a malicious URL to submit incorrect data to easycart.php feeding it malicious javascript WORKAROUNDS None at this time SOLUTIONS None at this time REFERENCES None TIMELINE October 3rd, 2006 Vendor/Developer Notified October 8th, 2006 Vendor/Developer notification returned. October 9th, 2006 Public Release ADDITIONAL CREDIT N/A LICENSE Creative Commons Attribution-ShareAlike License http://creativecommons.org/licenses/by-sa/2.5 -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.5 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFFKvXhzjnMaVYUP4QRAh6bAKC6C4ZG/KkYsijeVnC2AuiwvG1O1wCeNePN aVJsxgezSujUz7MNkJQavJ8= =Is2h -END PGP SIGNATURE- ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
[Full-disclosure] MHL-2006-002 Public Advisory: "Call-Center-Software" Multiple Security Issues
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 MHL-2006-002 - Public Advisory +---+ |Call-Center-Software Multiple Security Issues | +---+ PUBLISHED ON October 11th, 2006 PUBLISHED AT http://www.mayhemiclabs.com/advisories/MHL-2006-002.txt http://www.mayhemiclabs.com/wiki/wikka.php?wakka=MHL2006002 PUBLISHED BY Mayhemic Labs http://www.mayhemiclabs.com security AT mayhemiclabs DOT com GPG key: 0x56143F84 APPLICATION call-center software http://www.call-center-software.org/ "call-center-software is a free open-source application released under the GPL" AFFECTED VERSIONS Versions 0.93 and below ISSUES Call-Center-Software is vulnerable to multiple SQL injection attacks and XSS under certain conditons, along with privilege escalation. 1) XSS Call-Center-Software does not escape data when handling it allowing malicious javascript data to be inserted by any user.This is only when Magic Quotes is disabled within PHP. Example: A user entering alert("Moo!"); into the problem description field when submitting the problem, will cause the javascript to be executed upon viewing or editting the problem. 2) SQL Injection Call-Center-Software does not escape data when handling it allowing malicious users to inject SQL commands into the database. This is only when Magic Quotes is disabled within PHP. Example: By logging into the system with the user "'or 1=1 or 1='" the attacker is let into the system with full administrative privileges. 3) Privilege Escalation and Password Disclosure Call-Center-Software does not check access privileges when bringing up the "edit user" screen. This, also combined with the lack of hashed password, discloses any user on the system's password, username, and other information stored within the database. Example: When logged in as a non administrative user a user can go to edit_user.php?user_id=1 and view the default admin account's password. Changing the user_id variable discloses the corresponding account's data. WORKAROUNDS Enabling Magic Quotes will negate the XSS and SQL injection attacks on affected systems. SOLUTIONS None at this time REFERENCES call-center software - http://www.call-center-software.org/ TIMELINE September 25th, 2006 Vendor/Developer Notified Vendor/Developer Response Recieved Vendor/Developer Questioned on Patch Availability No response October 3rd, 2006 Vendor Followup Vendor/Developer Response Recieved Vendor/Developer Questioned on Patch Availability No response ADDITIONAL CREDIT N/A LICENSE Creative Commons Attribution-ShareAlike License http://creativecommons.org/licenses/by-sa/2.5 -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.5 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFFLazmzjnMaVYUP4QRAjMLAJwPkXBBfIjxcROLm+w4NgxPi+1XZQCgpW/F jz7P+B+SzCkde2WZOtAXFxE= =Gth+ -END PGP SIGNATURE- ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
[Full-disclosure] MHL-2006-003 Public Advisory: "ezOnlineGallery" Multiple Security Issues
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 MHL-2006-003 - Public Advisory +---+ | ezOnlineGallery Multiple Security Issues | +---+ PUBLISHED ON October 26th, 2006 PUBLISHED AT http://www.mayhemiclabs.com/advisories/MHL-2006-003.txt http://www.mayhemiclabs.com/wiki/wikka.php?wakka=MHL2006003 PUBLISHED BY Mayhemic Labs http://www.mayhemiclabs.com security AT mayhemiclabs DOT com GPG key: 0x56143F84 APPLICATION ezOnlineGallery http://www.ezonlinegallery.com/ AFFECTED VERSIONS Versions 1.3 and below ISSUES ezOnlineGallery allows disclosure of certain data about the system it is installed on. 1) Valid Path Disclosures By editing the album variable when the "show_album" action is called on ezgallery.php, an attacker can verify the existance of any directory on a system. The system will attempt to display an album if the path is valid, and will return an error if the path is invalid. EXAMPLE: ezgallery.php?action=show_album&album=../../../../../etc/ 2) File Disclosure By editing both the album and image variables on image.php an attacker can view any JPG, BMP, or PNG that the apache process has read access to. image.php?album=../../home/jrluser/girlfriendpics&image=nude.jpg WORKAROUNDS None at this time SOLUTIONS Upgrade to 1.3.2 Beta REFERENCES ezOnlineGallery - http://www.ezonlinegallery.com/ TIMELINE October 26th, 2006 Vendor/Developer Notified Vendor/Developer Fixes Issues Public Release ADDITIONAL CREDIT N/A LICENSE Creative Commons Attribution-ShareAlike License http://creativecommons.org/licenses/by-sa/2.5 -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.5 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFFQWG1zjnMaVYUP4QRAmn5AKCggkwoeoEwskcExkJtNnwWC4UBkQCgjetQ 1bjFMzRtPuveUAU6a0+ZaWg= =yUPA -END PGP SIGNATURE- ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
[Full-disclosure] MHL-2006-003 Public Advisory: "mboard" file creation issue
MHL-2006-004 - Public Advisory +---+ |mboard Security Issue | +---+ PUBLISHED ON November 26th, 2006 PUBLISHED AT http://www.mayhemiclabs.com/advisories/MHL-2006-004.txt http://www.mayhemiclabs.com/wiki/wikka.php?wakka=MHL2006004 PUBLISHED BY Mayhemic Labs http://www.mayhemiclabs.com security AT mayhemiclabs DOT com GPG key: 0x56143F84 APPLICATION MBoard - PHP message board http://www.phpjunkyard.com/php-message-board.php "MBoard is a PHP message board script (a simple forum)." AFFECTED VERSIONS Versions 1.22 and below ISSUES MBoard does not check the Post ID for malicious data when replying, allowing an attacker to create blank files on the system wherever the web server has write access. Example: An attacker can reply to a message, and edit the "orig_id" variable to something malicious ("../../../../../../tmp/ZOMGHAX") mboard will then create the specified file (appending the configured extension. WORKAROUNDS Enabling Magic Quotes will negate the issue. SOLUTIONS Upgrade to version 1.3 REFERENCES MBoard - http://www.phpjunkyard.com/php-message-board.php TIMELINE October 11th, 2006 Vendor/Developer Notified Vendor/Developer Response Recieved October 25th, 2006 Vendor/Developer Followup Vendor/Developer Response Recieved November 16th, 2006 Vendor/Developer Followup November 18th, 2006 New Version Released November 26th, 2006 Advisory Released ADDITIONAL CREDIT N/A LICENSE Creative Commons Attribution-ShareAlike License http://creativecommons.org/licenses/by-sa/2.5 ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/