Multiple SQL injection vulnerabilities in e107

Advisory ID:HTB22602
Product:e107 Website System
Vendor:e107
Vulnerable Versions:0.7.23 and probably prior
Tested Version:0.7.23
Advisory Publication:September 3, 2010 [without technical details]
Vendor Notification:September 3, 2010
Public Disclosure:September 17, 2010
Vulnerability Type:SQL Injection [CWE-89]
Risk Level:Medium
CVSSv2 Base Score:6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
Solution Status:Fixed by Vendor
Discovered and Provided:High-Tech Bridge Security Research Lab
 

Advisory Details:

High-Tech Bridge SA Security Research Lab has discovered three SQL injection vulnerabilities in e107 which could lead to execution of arbitrary SQL commands in application`s database.

1) SQL injection vulnerabilities in e107

1.1 An input validation error exists in the URL in /e107_admin/wmessage.php. A remote attacker can send a specially crafted HTTP GET request to the vulnerable script and execute arbitrary SQL commands in application`s database. Successful exploitation may allow an attacker to read, modify, add or delete arbitrary data but requires "Welcome message" permissions.
Exploitation example:
http://host/e107_admin/wmessage.php?create.edit.999999%0Aunion%0Aselect%0A1, 2,user%28%29

1.2 The vulnerability exists due input validation error in the URL in /e107_plugins/forum/forum_admin.php. A remote attacker can send a specially crafted HTTP GET request to the vulnerable script and execute arbitrary SQL commands in application`s database. Successful exploitation may allow an attacker to read, modify, add or delete arbitrary data but requires privileges to manage forums.

Exploitation example:
http://host/e107_plugins/forum/forum_admin.php?create.edit.9999999%0Aunion%0 Aselect%0A1,2,user(),4,5,6,7,8,9,10,11,12,13,14

1.3 An input validation error exists in the URL in /e107_admin/download.php. A remote attacker can send a specially crafted HTTP GET request to the vulnerable script and execute arbitrary SQL commands in application`s database. Successful exploitation may allow an attacker to read, modify, add or delete arbitrary data in database but requires "Post download" permissions.
Exploitation example:
http://host/e107_admin/download.php?cat.edit.999999%0Aunion%0Aselect%0A1,2,3 ,4,5,6,7

How to Detect SQL Injection Vulnerabilities
Free Website Security Test
  • Non-intrusive GDPR Test
  • Non-intrusive PCI DSS Test
Try Free Test
ImmuniWeb® On-Demand
  • Complete GDPR Audit
  • Complete PCI DSS Audit
  • Remediation Guidelines
  • DevSecOps Integration
Learn More

Solution:
Vendor has issued a fix for vulnerabilities 1.1 and 1.2 in version 0.7.25.
Vulnerability 1.3 was fixed in version 0.7.24.


References:
[1] High-Tech Bridge Advisory HTB22344 - https://www.immuniweb.com/advisory/HTB22602 - Cross-site request forgery (CSRF) in e107
[2] e107 - http://e107.org - e107 is an Advanced Content Publishing Solution for Website Pages, Documents, Menus and Links (Content Management System) powered by PHP and MySQL.
[3] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types.
User Comments
Add Comment


Have additional information to submit?
Please feel free to send us any additional information related to this Advisory, such as vulnerable versions, additional exploitation details and conditions, patches and other relevant details.
Quick Start
Solutions
Get a Demo
Newsletter