Advisory ID: HTB23191
Product: Horizon QCMS
Vendor: Horizon QCMS
Vulnerable Version(s): 4.0 and probably prior
Tested Version: 4.0
Advisory Publication: December 18, 2013 [without technical details]
Vendor Notification: December 18, 2013=20
Vendor Patch: December 25, 2013=20
Public Disclosure: January 8, 2014=20
Vulnerability Type: Path Traversal [CWE-22], SQL Injection [CWE-89]
CVE References: CVE-2013-7138, CVE-2013-7139
Risk Level: High=20
CVSSv2 Base Scores: 5 (AV:N/AC:L/Au:N/C:P/I:N/A:N), 7.5 (AV:N/AC:L/Au:N/C:P=
/I:P/A:P)
Solution Status: Fixed by Vendor
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://w=
ww.htbridge.com/advisory/ )=20
---------------------------------------------------------------------------=
--------------------
Advisory Details:
High-Tech Bridge Security Research Lab discovered multiple vulnerabilities =
in Horizon QCMS, which can be exploited to read contents of arbitrary files=
and perform SQL Injection attacks.
1) Path Traversal in Horizon QCMS: CVE-2013-7138
The vulnerability exists due to insufficient filtration of "start" HTTP GET=
parameter passed to "/lib/functions/d-load.php" script before using it in =
PHP "fopen()" function. A remote attacker can read contents of arbitrary fi=
les on the target system with privileges of the web server.
The exploitation example below will display content of "/config.php" file t=
hat contains MySQL database login credentials:
http://[host]/lib/functions/d-load.php?start=3D../../config.php
2) SQL Injection in Horizon QCMS: CVE-2013-7139
The vulnerability exists due to insufficient validation of "category" HTTP =
POST parameter passed to "/download.php" script. A remote unauthenticated a=
ttacker can execute arbitrary SQL commands in application's database.
The exploitation example below displays version of MySQL server:
http://[host]/download.php?category=3D%27%20union%20select%201,2,version(),=
4,5,6%20--%202
---------------------------------------------------------------------------=
--------------------
Solution:
Apply security patch for Horizon 4.0
More Information:
http://sourceforge.net/projects/hnqcms/files/patches/
---------------------------------------------------------------------------=
--------------------
References:
[1] High-Tech Bridge Advisory HTB23191 - https://www.htbridge.com/advisory/=
HTB23191 - Multiple vulnerabilities in Horizon QCMS.
[2] Horizon QCMS - http://www.hnqcms.com/ - An open source Horizon Quick Co=
ntent Managment System with PHP and MySQL support.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - in=
ternational in scope and free for public use, CVE=C2=AE is a dictionary of =
publicly known information security vulnerabilities and exposures.
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to =
developers and security practitioners, CWE is a formal list of software wea=
kness types.
[5] ImmuniWeb=C2=AE - http://www.htbridge.com/immuniweb/ - is High-Tech Bri=
dge's proprietary web application security assessment solution with SaaS de=
livery model that combines manual and automated vulnerability testing.
---------------------------------------------------------------------------=
--------------------
Disclaimer: The information provided in this Advisory is provided "as is" a=
nd without any warranty of any kind. Details of this Advisory may be update=
d in order to provide as accurate information as possible. The latest versi=
on of the Advisory is available on web page [1] in the References.