|
Description
|
|
Multiple vulnerabilities have been discovered in OneOrZero AIMS, which can be exploited by malicious users to conduct SQL injection attacks and by malicious people to conduct cross-site scripting attacks and bypass certain security restrictions.
1) Input passed via the "item_types" parameter to index.php (when "controller" is set to "app_oneorzerohelpdesk_main", "subcontroller" is set to "search_management_manage", and "option" is set to "show_item_search") is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
2) Input passed via the "oozimsrememberme" cookie parameter to index.php (when "Login" is set to "Login") is not properly sanitised in lib/ooz_access.php before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
3) An error due to improper authorisation check when the "oozimsrememberme" cookie parameter is set to certain values can be exploited to log-in as e.g. an administrative user and gain access to the administration panel.
4) Input passed via the URL to index.php is not properly sanitised in the "showSecurity()" function in controllers/main.php before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
The vulnerabilities are confirmed in version 2.8.0 Trial Edition build 231211. Other versions may also be affected.
|
|
|
|
|
|
Vulnerable Products
|
|
Vulnerable Software:
OneOrZero AIMS 2.x
|
|
|
|
|
|
Solution
|
|
Edit the source code to ensure that input is properly sanitised. Restrict access to trusted hosts only.
|
|
|
|
|
|
CVE
|
|
CVE-2011-4215
CVE-2011-4214
CVE-2010-4834
|
|
|
|
|
|
References
|
|
Valentin Hoebel:
http://www.xenuser.org/documents/security/OneOrZero_Aims_multiple_vulnerabilities.txt
US-CERT:
http://www.kb.cert.org/vuls/id/800227
PT-2011-20:
http://en.securitylab.ru/lab/PT-2011-20
PT-2011-21:
http://en.securitylab.ru/lab/PT-2011-21
HTB23066:
https://www.htbridge.ch/advisory/xss_in_oneorzero_aims.html
|
|
|
|
|
|
Vulnerability Manager Detection
|
|
No
|
|
|
|
|
|
IPS Protection
|
|
|
|
|
|
|
