Falt4 CMS Security Report/Advisory

[Mesut Timur]

H - Security=
Labs
Falt4Extreme (RC4 10.9.2007) Securi=
ty Report
ID : HSEC#200710=
12

General Information
--------------------------
Name : Falt4Extreme CMS (RC4 10.9.2007)
Vendor HomePage :http://sourceforge.net/projects/falt4/
Platforms : PHP && MySQL
Vulnerability Type : Input Validation Errors

Disclosure Timeline
-------------------------
04 December 2007 -- Vendor Contacted=20
04 December 2007 -- Vendor Replied
05 December 2007 -- Fix Released=20
10 December 2007 -- Pulic Disclosure

What is Falt4Extreme
------------------------
Falt4 CMS is a business approved Content Management System (CMS) under the =
LGPL. The CMS is feature-rich and has a clean administration area. The ulti=
mate CMS with functions for the professional, usable by everyone.CMS module=
s are available.

Overview of Vulnerabilities
------------------------
The script is vulnerable to both of XSS and Blind SQL Injection attacks.

Details of Vulnerabilities
------------------------
1-Blind SQL Injection Vulnerability:
http://www.EXAMPLE.com/falt4/
index.php?handler=3Dcat&nav_ID=3D1'%20and%20'1'=3D'1
nav_ID parameter is not sanitized properly and can be used for Blind SQL In=
jection attacks.
2-Cross Site Scripting Vulnerabilities
i.http://www.EXAMPLE.com/falt4/
index.php?handler=3D>">&nav_ID=3D1
Input passed to the 'handler' parameter is not sanitized properly before us=
ing and can be used malicious people to perform XSS attacks.

ii .http://www.EXAMPLE.com/falt4/
modules/feed/feed.php?type=3Drss&lang=3D1&topic=3D>">
Input passed to the 'topic' parameter is not sanitized properly before usin=
g and can be used malicious people to perform XSS attacks.

Solution
-----------------------
Re-download falt4 from sourceforge:
http://downloads.sourceforge.net/falt4/falt4extreme.zip?use_mirror=3Dosdn
Replace these files:
/yourfalt4/index.php
/yourfalt4/modules/feed.php
/yourfalt4/admin/index.php
-----------------------

The vulnerabilities found on 04 December 2007
by Mesut Timur=20
H - Security Labs , http://www.h-labs.org
Gebze Institute of Technology,=20
Department of Computer Engineering, http://www.gyte.edu.tr

References
-----------------------
Vendor Confirmation : http://sourceforge.net/forum/forum.php?forum_id=3D762=
931
Original Advisory : http://www.h-labs.org/blog/2007/12/05/falt4_cms_securit=
y_report_advisory.html
Project Site : http://sourceforge.net/projects/falt4/
Me : http://www.h-labs.org
__________________________________________________ _______________
Your smile counts. The more smiles you share, the more we donate.=A0 Join i=
n.
www.windowslive.com/smile?ocid=3DTXT_TAGLM_Wave2_oprsmilewlhmtagline=