Document Title: =============== SaltOS v3.0 r3311 - SQL Injection & File Include Vulnerability Release Date: ============= 2011-08-13 Vulnerability Laboratory ID (VL-ID): ==================================== 247 Product & Service Introduction: =============================== SaltOS is a eGroupware Business Management solution. It integrates features like CRM (Customer Relation Management) and ERP (Enterprise Resource Planning). Moreover is it licensed as 100% free software GPL-3.0. Features: Efficiency: SaltOS allows you to work in a dynamic and fast way. Moreover you will be able to consult, seek, and filter the information in an easy way. Centralised: SaltOS integrates commercial management, accounting and project management in only one application. It also includes every day work tools as e-mail, agenda and document manager. Accessibility: the only thing you need to work with SaltOS is a computer with internet and / or intranet access. SaltOS is a web application that can be accessed via any modern navigator (Google Chrome, Firefox and Internet Explorer 7 or higher) Easy to use: if you are reading this, you can start working with SaltOS right now. You will see it is as easy as navigating the Internet. Scalability: SaltOS doesn’t need powerful servers nor special hardware. The necessary machinery can be installed at your personal lap top or even at a high performing server. It is easy to migrate SaltOS from one system to another, according your company needs. Personalised: SaltOS can be personalised according your wishes, from the interface colours till adapting to your business needs and even being integrated with already existing solutions (back office). Extendible: SaltOS is not a closed nor static solution, it can be extended, modified and improved at any moment. Cost: you don’t have to pay royalties nor licences for using SaltOS. This cost saving enables you to invert money in improvements that will make SaltOS your personal solution. Safe: your data will be transferred encrypted which protects it from being seen by others. Once the data is stored, it will be protected by your Company s Operating System and Infrastructure. The liberty to choose your own provider: SaltOS is licensed by GPL-3, which allows you to choose the provider of your own choice. (Copy of the Vendor Website: http://www.saltos.net/portal/es/saltos.htm) Abstract Advisory Information: ============================== The Vulnerability-Lab Team discovered a remote SQL Injection & a local File Include vulnerability on the SaltOS v3.0-r3311 CMS. Vulnerability Disclosure Timeline: ================================== 2011-08-13: Discovery by Vulnerability-Lab Discovery Status: ================= Published Affected Product(s): ==================== Exploitation Technique: ======================= Remote Severity Level: =============== High Technical Details & Description: ================================ A remote SQL Injection vulnerability is detected on the new SaltOS v3.0-r3311 Content Management System. The vulnerability allows an attacker to inject/execute own sql statements to compromise the application dbms. Vulnerable Module(s): [+] Periodicas - ID --- SQL Error Logs --- SELECT action_title FROM ( SELECT CONCAT( link:periodicas( ,-id, ): ,LPAD(id,5,0)) id2, CASE id_cliente WHEN 0 THEN [No associated client] ELSE CONCAT( link:clientes( ,-id_cliente, ): ,cliente) END cliente, CASE id_cliente WHEN 0 THEN [No associated client] ELSE cliente END cliente2, dia, CONCAT( CASE SUBSTR(meses,1,1) WHEN 1 THEN Jan ELSE END, CASE SUBSTR(meses,2,1) WHEN 1 THEN Feb ELSE END, CASE SUBSTR(meses,3,1) WHEN 1 THEN Mar ELSE END, CASE SUBSTR(meses,4,1) WHEN 1 THEN Apr ELSE END, CASE SUBSTR(meses,5,1) WHEN 1 THEN May ELSE END, CASE SUBSTR(meses,6,1) WHEN 1 THEN Jun ELSE END, CASE SUBSTR(meses,7,1) WHEN 1 THEN Jul ELSE END, CASE SUBSTR(meses,8,1) WHEN 1 THEN Aug ELSE END, CASE SUBSTR(meses,9,1) WHEN 1 THEN Sep ELSE END, CASE SUBSTR(meses,10,1) WHEN 1 THEN Oct ELSE END, CASE SUBSTR(meses,11,1) WHEN 1 THEN Nov ELSE END, CASE SUBSTR(meses,12,1) WHEN 1 THEN Dec ELSE END) meses, base,ROUND(base+iva2-irpf2,2) total, CASE id_cuenta WHEN 0 THEN [No account] ELSE cuenta END cuenta, conceptos, (SELECT COUNT(*) FROM tbl_periodicas_v v WHERE v.id_periodica=d.id) vencimientos, id action_id, CONCAT(LPAD(id,5,0), - ,cliente) action_title, CASE (1) WHEN 1 THEN true ELSE false END action_view, CASE (1) WHEN 1 THEN true ELSE false END action_edit, CASE 1 AND ((1) OR (1)) WHEN 1 THEN true ELSE false END action_copy, CASE (1) OR (1) WHEN 1 THEN true ELSE false END action_home, CASE (1) WHEN 1 THEN true ELSE false END action_delete FROM (SELECT c.*,ROUND(base*iva/100.0,2) iva2,ROUND(base*irpf/100.0,2) irpf2 FROM (SELECT a.*, ROUND(SUM(precio*unidades*(100.0-descuento)/100.0),2) base, COUNT(b.id) conceptos, e.id_usuario id_usuario,e.id_grupo id_grupo,j.nombre cuenta,IFNULL(l.nombre, ) cliente FROM tbl_periodicas a LEFT JOIN tbl_cuentas j ON a.id_cuenta=j.id LEFT JOIN tbl_clientes l ON a.id_cliente=l.id LEFT JOIN tbl_periodicas_c b ON a.id=b.id_periodica LEFT JOIN tbl_registros e ON e.id=(SELECT MIN(id) FROM tbl_registros WHERE id_aplicacion= 29 AND id_registro=a.id) GROUP BY a.id) c) d WHERE action_id IN (1) ORDER BY id desc) tbl_listsim Pictures: ../1.png 1.2 A local File Include vulnerability is detected on the new SaltOS v3.0-r3311 Content Management System. The vulnerability allows an attacker to request local directory cms & configuration files. Vulnerable Module(s): [+] ?x&files= Pictures: ../2.png Proof of Concept (PoC): ======================= The vulnerabilities can be exploited by remote attackers & local low privileged user accounts. For demonstration or reproduce ... 1.1 PoC http://www.vulnerability-lab.com/saltos/user/xml.php?page=periodicas&action=form&id=[SQL-Injection!]&order=id+desc&limit=50 &offset=0&id_cliente=&id_cuenta=&dia1=&dia2=&meses=&filter=&savedfilters=&newfilter= 1.2 http://www.vulnerability-lab.com/saltos/user/xml.php?action=cache&files[FILE-INCLUDE!].php&r=3311 Security Risk: ============== The security risk of the sql injection vulnerability is estimated as high. The security risk if the local file include vulnerability is estimated as medium. Credits & Authors: ================== Vulnerability Research Laboratory Disclaimer & Information: ========================= The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties, either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability- Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases or trade with fraud/stolen material. Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.vulnerability-lab.com/register Contact: admin@vulnerability-lab.com - support@vulnerability-lab.com - research@vulnerability-lab.com Section: video.vulnerability-lab.com - forum.vulnerability-lab.com - news.vulnerability-lab.com Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact (admin@vulnerability-lab.com or support@vulnerability-lab.com) to get a permission. Copyright © 2012 | Vulnerability Laboratory