[Bkis-01-2010] Multiple Vulnerabilities in BigAce - Bkis

["Bkis" <minhbq@xxxxxxxxxxx>]

[Bkis-01-2010] Multiple Vulnerabilities in BigAce
 
1. General Information
 
BigAce is a free content management software (CMS) written in PHP, and is 
available at http://www.bigace.de. In April 2010, Bkis Security discovered an 
XSS and CSRF vulnerability in BigAce 2.7.1. Taking advantage of this 
vulnerability, hacker is able to insert pieces of code into the path’s link to 
execute in users’ browser, leading to the loss of cookies and session. Hacker 
can also trick users into manipulating some of the system’s functions without 
users’ awareness.
 
Bkis has informed the software developer team, and they have patched the 
vulnerability in the latest software version -  BigAce 2.7.2.
 
Details: http://security.bkis.com/multiple-vulnerabilities-in-bigace-5/
SVRT Advisory: Bkis-01-2010
Initial vendor notification: 04/26/2010
Release Date: 05/22/2010
Update Date: 05/22/2010
Discovered by: Truong Thao Nguyen
Attack Type: XSS, CSRF
Security Rating: High
Impact: Code Execution
Affected Software: BigAce (version <= 2.7.1)
 
2. Technical Description
 
The XSS vulnerability of the software was found in the following modules:
- Create category
- Create Style sheet
- Create Template
- Edit template
- Create Group
- New permission
- Create new configuration
- Comunties
 
Because the input variants of this function are not carefully checked and 
filtered, hacker is able to insert pieces of code into the path’s link. When 
users sign in and click this link, the malicious code (JavaScript) will be 
executed, and users may lose their cookies, session, etc. 
 
The CSRF vulnerability of the software was found in the following modules:
- Delete category
- Delete style sheet
- Delete template
- Delete layout
- Delete group
- Active Permission
- Active Modules
 
Because a task performance process is not authenticated, users can be tricked 
into manipulating a task without awareness. Thus, hacker is able to perform his 
malicious tricks via a legitimate user.
 
3. Solution
Bkis recommends all organizations and individuals who are using BigAce to 
immediately update the latest software version. 
Download: http://www.bigace.de/BIGACE-2.7.2.html
 
4. About Bkis
Bkis is Vietnamese leading Company in researching, deploying network security 
software and solutions.
Official website: http://www.bkis.com
Blog: http://blog.bkis.com and http://security.bkis.com
 

----------------------------------------------------------------
Bui Quang Minh
Manager - Vuln Team - Bkis Security - Bkis

Office : Hitech building - 1A Dai Co Viet, Hanoi Tel : 84 4 8684757 ext. 119 
Mobile : 84 98 64 64 517 Email : minhbq@xxxxxxxxxxx Website : www.bkav.com.vn 
Blog : blog.bkis.vn
----------------------------------------------------------------
Do your best, the rest will come !
Hãy làm việc hết mình, những điều tốt đẹp sẽ đến với bạn!

Disclaimer: This e-mail and any files transmitted with it are confidential and 
may contain privileged information. It is intended solely for the use of the 
individual to whom it is addressed and others authorized to receive it. If you 
are not the intended recipient you are notified that disclosing, copying, 
distributing or taking any action in reliance on the contents of this 
information is strictly prohibited. If you have received this message in error, 
please notify the sender immediately by reply e-mail and delete completely this 
e-mail from your system, without reproducing, distributing or retaining copies.