CVE-2006-3583
CVSS7.5
发布时间 :2006-08-08 19:04:00
修订时间 :2008-09-05 00:00:00
NMCOPS    

[原文]Session fixation vulnerability in Jetbox CMS 2.1 SR1 allows remote attackers to hijack web sessions via a crafted link and the administrator section.


[CNNVD]Jetbox CMS 特制连接会话劫持攻击漏洞(CNNVD-200608-105)

        Jetbox CMS 2.1 SR1存在会话劫持攻击漏洞,远程攻击者可借助一个特制的连接和管理员专区劫持网络会话。

- CVSS (基础分值)

CVSS分值: 7.5 [严重(HIGH)]
机密性影响: PARTIAL [很可能造成信息泄露]
完整性影响: PARTIAL [可能会导致系统文件被修改]
可用性影响: PARTIAL [可能会导致性能下降或中断资源访问]
攻击复杂度: LOW [漏洞利用没有访问限制 ]
攻击向量: [--]
身份认证: NONE [漏洞利用无需身份认证]

- CWE (弱点类目)

CWE-287 [认证机制不恰当]

- CPE (受影响的平台与产品)

产品及版本信息(CPE)暂不可用

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3583
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-3583
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200608-105
(官方数据源) CNNVD

- 其它链接及资源

http://www.securityfocus.com/bid/19303
(UNKNOWN)  BID  19303
http://www.securityfocus.com/archive/1/archive/1/441980/100/0/threaded
(UNKNOWN)  BUGTRAQ  20060802 Secunia Research: Jetbox Multiple Vulnerabilities
http://www.osvdb.org/27710
(UNKNOWN)  OSVDB  27710
http://securityreason.com/securityalert/1339
(UNKNOWN)  SREASON  1339
http://secunia.com/secunia_research/2006-57/advisory/
(UNKNOWN)  MISC  http://secunia.com/secunia_research/2006-57/advisory/
http://secunia.com/advisories/20889
(VENDOR_ADVISORY)  SECUNIA  20889

- 漏洞信息

Jetbox CMS 特制连接会话劫持攻击漏洞
高危 输入验证
2006-08-08 00:00:00 2006-08-10 00:00:00
远程  
        Jetbox CMS 2.1 SR1存在会话劫持攻击漏洞,远程攻击者可借助一个特制的连接和管理员专区劫持网络会话。

- 公告与补丁

        暂无数据

- 漏洞信息 (F49006)

secunia-jetbox.txt (PacketStormID:F49006)
2006-08-17 00:00:00
Sven Krewitt  secunia.com
advisory,vulnerability,xss,sql injection
CVE-2006-3583,CVE-2006-3584,CVE-2006-3585,CVE-2006-3586
[点击下载]

Secunia Research has discovered some vulnerabilities in Jetbox CMS version 2.1 SR1, which can be exploited by malicious people to conduct session fixation attacks, disclose certain system information, conduct cross-site scripting, script insertion, and SQL injection attacks, and compromise a vulnerable system.

====================================================================== 

                     Secunia Research 02/08/2006

                  - Jetbox Multiple Vulnerabilities -

====================================================================== 
Table of Contents

Affected Software....................................................1
Severity.............................................................2
Vendor's Description of Software.....................................3
Description of Vulnerability.........................................4
Solution.............................................................5
Time Table...........................................................6
Credits..............................................................7
References...........................................................8
About Secunia........................................................9
Verification........................................................10

====================================================================== 
1) Affected Software 

Jetbox CMS 2.1 SR1

Other versions may also be affected.

====================================================================== 
2) Severity 

Rating: Highly critical
Impact: System access
        Exposure of system information
        Manipulation of data
        Cross-Site Scripting
        Hijacking
Where:  From remote

====================================================================== 
3) Vendor's Description of Software 

"Jetbox content management system is seriously tested on usability &
has a professional intuitive interface.".

Product Link:
http://jetbox.streamedge.com/index.php

====================================================================== 
4) Description of Vulnerability

Secunia Research has discovered some vulnerabilities in Jetbox CMS,
which can be exploited by malicious people to conduct session fixation
attacks, disclose certain system information, conduct cross-site
scripting, script insertion, and SQL injection attacks, and compromise
a vulnerable system.

1) An error in the handling of sessions during login to the
administration section can be exploited to hijack another user's
session by tricking the user into logging in after following a
specially crafted link.

2) Input passed via the URL is not properly sanitised before being 
used in a dynamic variable evaluation in index.php. This can be 
exploited to overwrite certain configuration variables. 

Successful exploitation e.g. leads to disclosure of certain system
information via phpinfo or execution of arbitrary HTML and script code
in a user's browser session in context of an affected site.

3) Input passed to the "login" parameter in admin/cms/index.php is not
properly sanitised before being returned to the user. This can be
exploited to execute arbitrary HTML and script code in a user's 
browser session in context of an affected site.

4) Input passed to formmail.php via the "Supply news" page is not
properly sanitised before being returned to the user. This can be
exploited to execute arbitrary HTML and script code in a user's 
browser session in context of an affected site.

This is related to:
SA13576

5) Input passed via the URL is not properly sanitised before being
returned in the "Site statistics" page in the administration section.
This can be exploited to insert arbitrary HTML and script code, which
is executed in an administrative user's browser session in context of
an affected site when statistics are viewed.

6) Input passed to the "query_string" form field parameter when
performing a search is not properly sanitised before being used. This
can be exploited to insert arbitrary HTML and script code, which is
executed in an administrative user's browser session in context of an
affected site when search statistics are viewed.

7) Input passed to the "frontsession" cookie parameter, the "view"
parameter in index.php, and to the "login" parameter in
admin/cms/index.php is not properly sanitised before being used in SQL
queries. This can be exploited to manipulate SQL queries by injecting
arbitrary SQL code.

Successful exploitation may lead to execution of arbitrary PHP code by
including files from external resources, but requires that
"magic_quotes_gpc" is disabled.

====================================================================== 
5) Solution 

Use another product.

====================================================================== 
6) Time Table 

14/07/2006 - Initial vendor notification.
21/07/2006 - Second vendor notification.
02/08/2006 - Public disclosure.

====================================================================== 
7) Credits 

Discovered by Sven Krewitt, Secunia Research.

====================================================================== 
8) References

The Common Vulnerabilities and Exposures (CVE) project has assigned
CVE-2006-3583 (session fixation), CVE-2006-3584 (overwriting
configuration variables), CVE-2006-3585 (cross-site scripting and
script insertion), and CVE-2006-3586 (SQL injection) for the
vulnerabilities.

====================================================================== 
9) About Secunia 

Secunia collects, validates, assesses, and writes advisories regarding 
all the latest software vulnerabilities disclosed to the public. These 
advisories are gathered in a publicly available database at the 
Secunia website:

http://secunia.com/

Secunia offers services to our customers enabling them to receive all 
relevant vulnerability information to their specific system 
configuration. 

Secunia offers a FREE mailing list called Secunia Security Advisories: 

http://secunia.com/secunia_security_advisories/

====================================================================== 
10) Verification 

Please verify this advisory by visiting the Secunia website:
http://secunia.com/secunia_research/2006-57/

Complete list of vulnerability reports published by Secunia Research:
http://secunia.com/secunia_research/

======================================================================




    

- 漏洞信息

27710
Jetbox CMS Administration Section Session Fixation
Remote / Network Access Input Manipulation
Loss of Integrity

- 漏洞描述

Jetbox CMS contains a flaw that may allow a malicious user to hijack a user's session. The issue is triggered when the victim uses a specially-crafted link to login to the administration section. It is possible that the flaw may allow the attacker to hijack the session using the fixated session ID after the victim logs in resulting in a loss of integrity.

- 时间线

2006-08-02 2006-07-14
Unknow Unknow

- 解决方案

Currently, there are no known upgrades, patches, or workarounds available to correct this issue.

- 相关参考

- 漏洞作者

- 漏洞信息

Jetbox Multiple Input Validation Vulnerabilities
Input Validation Error 19303
Yes No
2006-08-02 12:00:00 2006-09-11 09:07:00
Sven Krewitt of Secunia Research has been credited with discovery of these vulnerabilities.

- 受影响的程序版本

Jetbox Jetbox CMS 2.1 SR1

- 漏洞讨论

Jetbox is prone to multiple input-validation vulnerabilities because it fails to sanitize user input.

An attacker can exploit these issues to retrieve sensitive information, to gain administrative privileges, and to perform cross-site scripting, HTML-injection, and SQL-injection attacks.

Jetbox CMS 2.1 SR1 is vulnerable to this issue; others versions may also be affected.

- 漏洞利用

Attackers can exploit these issues via a web client.

- 解决方案

Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: vuldb@securityfocus.commailto:vuldb@securityfocus.com.

- 相关参考

 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站