|
Brought to you by:
Suppliers of:
|
|
|
| |
Web Wiz Forums "is a free award winning ASP bulletin board system software, which can add value to almost any web site".
A vulnerability in the product allows remote attackers to post messages into private forums, and read private messages found in private forums (all without having authorization to do so). |
| |
Credit:
The information has been provided by Alexander Antipov.
|
| |
Vulnerable systems:
* Web Wiz Forums version 6.34
* Web Wiz Forums version 7.01
* Web Wiz Forums version 7.5
Immune systems:
* Web Wiz Forums version 7.51
The Web Wiz Forums does not verify whether someone is allowed access to the message or forum when "quote" mode is used. As a result, remote user (authenticated or not) can read and post messages in private forums, to which he does not have access to.
Example:
* User "A" has read and write access to Forum1 (FID=1) and no access to Forum2 (FID=2)
* A message with PID=1111 (in topic TID=11) belong to Forum2 (FID=2)
* User "A" has no access to topic TID=11 with message PID=1111
However, user "A" can use "quote" mode for message PID=1111 with Forum1 (FID=1) (instead of FID=2), allowing him to read the private message and answer it. This is done by using the following URL:
http://webwizforum/post_message_form.asp?mode=quote&PID=1111&FID=1&TID=11&TPN=1
(Instead of PID=1111&FID=2&TID=11&TPN=1)
Solution:
-- begin snip post_message_form.asp ----
'If this is a quoted message read in the message to be quoted If strMode = "quote" Then
'Get the number this thread is after
intTotalNumOfThreads = Request.QueryString("NOP")
'Get the return thread page
intRecordPositionPageNum = Request.QueryString("TPN")
--- bug fix by pharaoh ----
strSQL = "SELECT " & strDbTable & "Topic.Subject FROM " & strDbTable & "Topic "
strSQL = strSQL & "WHERE " & strDbTable & "Topic.Forum_ID = " &
CLng(Request.QueryString("FID"))
strSQL = strSQL & "AND " & strDbTable & "Topic.Topic_ID = " &
CLng(Request.QueryString("TID"))
rsCommon.Open strSQL, adoCon
If rsCommon.EOF Then
rsCommon.Close
Set rsCommon = Nothing
Set adoCon = Nothing
Set adoCon = Nothing
Response.Redirect "insufficient_permission.asp"
End If
rsCommon.Close
strSQL = "SELECT " & strDbTable & "Author.Author_ID, " & strDbTable & "Author.Username, " & strDbTable & "Thread.Message "
strSQL = strSQL & "FROM " & strDbTable & "Thread INNER JOIN " & strDbTable & "Author ON " & strDbTable & "Thread.Author_ID = " & strDbTable & "Author.Author_ID "
strSQL = strSQL & "WHERE " & strDbTable & "Thread.Thread_ID = " &
CLng(Request.QueryString("PID"))
strSQL = strSQL & "AND " & strDbTable & "Thread.Topic_ID = " &
CLng(Request.QueryString("TID"))
rsCommon.Open strSQL, adoCon
If rsCommon.EOF Then
rsCommon.Close
Set rsCommon = Nothing
Set adoCon = Nothing
Set adoCon = Nothing
Response.Redirect "insufficient_permission.asp"
End If
--- bug fix by pharaoh ----
-- end snip post_message_form.asp ----
|
|
|
|
|
