Document Title: =============== Achievo v1.4.3 - Multiple Web Vulnerabilities References (Source): ==================== http://www.vulnerability-lab.com/get_content.php?id=403 http://www.cnnvd.org.cn/vulnerability/show/cv_id/2012020060 ID: CNNVD-201202-060 Release Date: ============= 2012-01-29 Vulnerability Laboratory ID (VL-ID): ==================================== 403 Common Vulnerability Scoring System: ==================================== 8.3 Product & Service Introduction: =============================== Achievo is a flexible web-based resource management tool for business environments. Achievo s resource management capabilities will enable organisations to support their business processes in a simple, but effective manner. A solution that fits seamlessly to the wishes of every organisation and offers the possibility and freedom to adapt the functionality to the needs of the organisation. It will fit into every organisation because Achievo is extremly easy to change to your specific situation. (Copy of the Vendor Website: http://www.achievo.nl/product/ ) Abstract Advisory Information: ============================== Vulnerability-Lab Team (Chokri B.A.) discovered Multiple Web Vulnerabilities on the resource management tool Achievo v1.4.3. Vulnerability Disclosure Timeline: ================================== 2012-01-30: Public or Non-Public Disclosure Discovery Status: ================= Published Exploitation Technique: ======================= Remote Severity Level: =============== High Technical Details & Description: ================================ 1.1 A blind SQL vulnerability is detected in the resource management tool Achievo v1.4.3 Content Management System. The sql injection bug allows remote attackers to inject own sql commands on the affected (vulnerable) web application dbms. The vulnerability is located in every module in the atkstackid (session) module with the bound vulnerable id parameter request. Exploitation requires no user interaction or privileged application user account. Successful exploitation of the vulnerability results in web application and dbms compromise via sql injection attack. Vulnerable Module(s): (Example) [+] Download vcard [+] ... & all -id bound requests Vulnerable Parameter(s): [+] tkstackid session - ID 1.2 Multiple persistent input validation web vulnerabilities are detected in the resource management tool Achievo v1.4.3. The bug allows remote attacker to implement/ inject own malicious script code on the application-side (persistent). The first vulnerability is located in the user preferences module with the bound vulnerable search all parameter request. The second vulnerability is located in the projects module with the bound vulnerable fieldlabel parameter request Successful exploitation of the vulnerability results in persistent session hijacking (user/mod/admin), persistent phishing, persistent redirects or malware loads and persistent web context manipulation. Exploitation requires low privileged application user account and low or medium required user interaction. Vulnerable Module(s): [+] Users preferences [+] Projects Vulnerable Parameter(s): [+] Search All [+] Name Proof of Concept (PoC): ======================= 1.1 The sql injection vulnerability can be exploited by remote attackers without user interaction and without privileged application user account. For demonstration or reproduce ... PoC: http://127.0.0.1:2323/achievo/stable/dispatch.php?atkaction=vcard&atklevel=1&atkprevlevel=0&atkstackid=4f2467eae0518&id=3'-1[SQL INJECTION Vulnerability!]-- --- SQL Exception Logs --- Critical: Unknown error: 1064 (You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'contact') ORDER BY person.role, person.lastname' at line 1). Halted error: [+0.19090s / 0.00036s] Unknown error: 1064 (You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'contact') ORDER BY person.role, person.lastname' at line 1) Halted... 1.2 The persistent web vulnerabilities can be exploited by remote attackers with low required user inter action. For demonstration or reproduce ... Review: Search ALL