oss-security - Fwd: Multiple Vulnerabilities in Simple HRM system v2.3 and below

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CALuSjqYcm73nVmt43vw_h23JxkrHDZJLPgE56A4WKqHf7MN_cA@mail.gmail.com>
Date: Wed, 17 Apr 2013 11:07:06 +0800
From: Doraemon Sk8ers <doraemon.sk8ers@...il.com>
To: oss-security@...ts.openwall.com
Subject: Fwd: Multiple Vulnerabilities in Simple HRM system v2.3 and below

Hi,

There is a Blind SQL injection vulnerability and Cookie Integrity
Protection Vulnerability in Simple HRM system v2.3 and below.
The 2 vulnerabilities had been assigned the CVE identifier CVE-2013-2498
and CVE-2013-2499 respectively.

# Vendor Homepage: http://www.simplehrm.com/
# Software Link: http://sourceforge.net/projects/simplehrm/
# Version: 2.2/2.3
# Tested on: 2.2 & 2.3
# CVE : CVE-2013-2498, CVE-2013-2499

Details:
-----------
*
*
*CVE-2013-2498*

Simple HRM system is vulnerable to sqli attacks in their login page.
Carefully crafted requests can use the scope to inject arbitrary
SQLthrough the login form and obtain information such as password
hash.

*Attack URL:* http://localhost/simplehrm/index.php/user/setLogin
*Method:* POST
*Vuln Parameter: *username=*(SQL INJECTION)*&password=abcdef
*Vuln Type*: unsanitised input argument *($name)* in

*Vuln **File:* simlehrm/flexycms/modules/user/user_manager.php
*Line:* 84
    $res_company = getsingleindexrow('CALL
get_search_sql("'.TABLE_PREFIX.'company","email_id = \''.$name.'\' AND
isactive = 1 LIMIT 1")');

*CVE-2013-2499*

We discovered that if an attacker were to grab hold of the user's password
hash, the attacker can easily spoof a cookie and impersonate as anyone to
access the system. Together with the blind sql injection stated above, an
attacker can simply blind the password hash, userid, username and recreate
a cookie.

*Vuln **File:* simlehrm/flexycms/modules/user/user_manager.php
*Line:* 215
    $v_user_password =
md5($info['id_user'].$info['username'].$info['password']);

This vuln effectively defeats one of the primary purposes of password hashing.

*
*

Timeline:
-------------

Date Discovered: 07 March 2013
Vendor notified: 12 march 2013
Advisory posted: 12 April 2013 (No response from Vendor, published)

Regards

Team Doraemon.Sk8ers

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.