The vulnerable system is bound to the network stack and the set of possible attackers extends beyond the other options listed below, up to and including the entire Internet. Such a vulnerability is often termed “remotely exploitable” and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers). An example of a network attack is an attacker causing a denial of service by sending a specially crafted TCP packet across a wide area network (e.g., CVE-2004-0230).
Attack Complexity
Low
AC
The attacker must take no measurable action to exploit the vulnerability. The attack requires no target-specific circumvention to exploit the vulnerability. An attacker can expect repeatable success against the vulnerable system.
Privileges Required
None
PR
The attacker is unauthenticated prior to attack, and therefore does not require any access to settings or files of the vulnerable system to carry out an attack.
Scope
S
An exploited vulnerability can affect resources beyond the security scope managed by the security authority that is managing the vulnerable component. This is often referred to as a 'privilege escalation,' where the attacker can use the exploited vulnerability to gain control of resources that were not intended or authorized.
Confidentiality
Low
C
There is some impact on confidentiality, but the attacker either does not gain control of any data, or the information obtained does not have a significant impact on the system or its operations.
Integrity
Low
I
Modification of data is possible, but the attacker does not have control over what can be modified, or the extent of what the attacker can affect is limited. The data modified does not have a direct, serious impact on the system.
Availability
None
A
There is no impact on the availability of the system; the attacker does not have the ability to disrupt access to or use of the system.
[Bkis-13-2009] e107 Multiple Vulnerabilities
1. General Information
e107 is a free content management system (CMS) written in PHP language
and is available at http://e107.org/news.php . In October 2009, Bkis
Security discovered a number of XSS and Blind SQL Injection
vulnerabilities on this system. Taking advantage of these holes, hackers
can insert arbitrary malicious codes onto users' browsers, then steal
private information or carry out requests to the website to gain
complete control of the website's database.
Details: http://blog.bkis.com/e107-multiple-vulnerabilities/
SVRT Advisory: Bkis-13-2009
Initial vendor notification: 10/28/09
Release Date: 11/23/09
Update Date: 11/23/09
Discovered by: Do Hoang Bach, Bkis
Attack Type: XSS, SQL Injection
Security Rating: High
Impact: Code Execution
Affected Software: E107 (ver <= 0.7.16)
2. Technical details
The found XSS holes reside in the following modules:
- submitnews.php
- usersettings.php.
- e107_admin/newpost.php.
- e107_admin/banlist.php.
- e107_admin/banner.php.
- e107_admin/cpage.php
- e107_admin/download.php.
- e107_admin/users_extended.php.
- e107_admin/frontpage.php.
- e107_admin/links.php.
- e107_admin/mailout.php.
To be specific, the flaws on these modules are results of inadequate
check of input variables, allowing hackers to insert scripts onto the
links before sending them to e107's users. When users log in to e107 and
click on these links, the malicious codes will be executed on their
browsers. By this way, hackers can harvest cookies, sessions, etc on
the infected machines and, therefore, are able to steal secret
information of users.
The Blind SQL Injection hole lies in Search function of the website.
Exploiting this hole, hackers can carry out any requests to the website
and get the complete control of the its database.
3. Solution
As these are dangerous vulnerabilities, Bkis has notified e107's
developer of the problem. Besides, we recommend that individuals,
organizations using e107 be cautious of links from unclear origins, and
regularly check for patch on e107's website.
--------------
http://blog.bkis.com
This information is provided for TESTING and LEGAL RESEARCH purposes only. All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use and Privacy Policy and Impressum