Exploit-DB #27006
Description: Barracuda CudaTel 2.6.02.040 - SQL Injection
Type: webapps
Platform: hardware
Date: 2013-07-22
Author: Vulnerability-Lab

Exploit:
Title:
======
Barracuda CudaTel 2.6.02.040 - Remote SQL Injection Vulnerability


Date:
=====
2013-07-20


References:
===========
http://vulnerability-lab.com/get_content.php?id=775

BARRACUDA NETWORK SECURITY ID: BNSEC-723


VL-ID:
=====
775


Common Vulnerability Scoring System:
====================================
8.6


Introduction:
=============
Designed to enable seamless voice and video communication, the CudaTel Communication Server is an easy-to-use, 
affordable, next-generation phone system for businesses. CudaTel Communication Server s enterprise-class 
feature set includes Voice over IP (VoIP) PBX services, conferencing, follow-me, automated attendant services, 
and more, controlled by an easy-to-use Web interface. CudaTel Communication Server is compatible with any SIP 
device and provider, and can be pre-configured for use with both analog and digital telephone networks. Powerful, 
Complete Solution With an expansive feature set and and no per user or phone licensing fees, the CudaTel 
Communication Server is equipped and priced for organizations of any size. Native High Definition audio support 
and integrated phone line (TDM) hardware produces an unparalleled audio experience. VOIP encryption protects calls 
from hackers and digital eavesdroppers.

(Copy of the Vendor Homepage: http://www.barracudanetworks.ca/cudatel.aspx )


Abstract:
=========
1.1
The Vulnerability Laboratory Research Team discovered a sql injection vulnerability in Barracuda Networks CudaTel v2.6.002.040 appliance application.

1.2
The Vulnerability Laboratory Research Team discovered a client side vulnerability in Barracuda Networks CudaTel v2.6.002.040 appliance application.


Report-Timeline:
================
2012-11-26:	Researcher Notification & Coordination (Benjamin Kunz Mejri)
2012-11-27:	Vendor Notification (Barracuda Networks Security Team - Bug Bounty Program)
2012-12-01:	Vendor Response/Feedback (Barracuda Networks Security Team - Bug Bounty Program)
2013-03-01:	Vendor Fix/Patch (Barracuda Networks Developer Team) [Manager: Dave Farrow]
2013-07-20:	Public Disclosure (Vulnerability Laboratory)


Status:
========
Published


Affected Products:
==================
Barracuda Networks
Product: CudaTel - Communication Server 2.6.002.040


Exploitation-Technique:
=======================
Remote


Severity:
=========
Critical


Details:
========
1.1
A SQL Injection vulnerability is detected in the Barracuda Networks CudaTel v2.6.002.040 appliance web application.
The vulnerability allows remote attackers or local low privilege application user accounts to inject (execute) 
own SQL commands to the affected application dbms. 

The blind sql injection vulnerability is located in the cdr module when processing to request manipulated row & page 
parameters as searchstring. A remote attacker can for example delete the standard value context of the module request 
to inject (execute) own sql commands. 

Eploitation of the vulnerability requires a low privilege web application user account and no user interaction.
Successful exploitation of the vulnerability results in datbase management system and web application compromise.

Vulnerable Section(s)
				[+] search - listing

Vulnerable Module(s)
				[+] cdr - seachstring listing

Vulnerable Parameter(s)
				[+] &row
				[+] &page



1.2
A client side input validation vulnerability is detected in the Barracuda Networks CudaTel v2.6.002.040 appliance web application.
The non-persistent vulnerability allows remote attackers to manipulate client side application requests to browser.

The secound vulnerability (client side) is located in the invalid value exception handling. Remote attackers can provoke the 
exception-handling by including invalid script code inputs to redisplay the malicious context when processing to load the output.
To provoke the exception-handling the remote attacker can use the vulnerable row parameter of the cdr searchstring listing to 
execute own malicious (client-side) script code.

Exploitation of the vulnerability requires a no web application user account but medium or high user interaction.
Successful exploitation of the vulnerability results in client side phishing, client side session hijacking and client side 
external redirects to malware or malicious websites. Exploitation requires medium user interaction.

Vulnerable Section(s):
				[+] search - listing

Vulnerable Module(s):
				[+] cdr - seachstring listing

Vulnerable Parameter(s):
				[+] &row

Affected Module(s):
				[+] Exception-Handling (invalid value)


Proof of Concept:
=================
1.1
The sql injection vulnerability can be exploited by remote attackers with low privilege web application user account and without user interaction.
For demonstration or reproduce ...

Standard Request: Row 100
http://cudatel.127.0.0.1:1336/gui/cdr/cdr?_=[PII_REDACTED]09&since=1+day&search_string=&rows=100&page=1&sortby=end_timestamp&sortorder=desc

Standard Request: Output
--- 1.
{"count":0,"page":"1","cdr":[],"rows":"100"}


Manipulated Request: 
http://cudatel.127.0.0.1:1337/gui/cdr/cdr?
_=[PII_REDACTED]09&since=1+day&search_string=&rows=100&page='1+1%27[SQL-Injection!]%27--&sortby=end_timestamp&sortorder=desc
... or
http://cudatel.127.0.0.1:1337/gui/cdr/cdr?
%20%20_=[PII_REDACTED]09&since=1+day&search_string=&page='1335&page='1336&page='1337&rows='1+1%27[SQL-Injection!]%27--&page=1&sortby=end_timestamp&sortorder=desc


Manipulated Output:
--- 1.

cdr: []

count: 0
page: 1
rows: 1+2


--- 1.
cdr: []

count: 1+2'
page: 
  - '1335
  - '1336
  - '1337
  - '1
rows: -1+1'[SQL-Injection!]'--


Exploit (PoC):

<html><head><body><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-9">
<title>Barracuda Networks CudaTel [CDR] (ROW&PAGE) - Remote SQL-Injection [PROOF OF CONCEPT]</title>
<script language="J