|
Description
|
|
Brendan Coles has discovered multiple vulnerabilities in CuteFlow, which can be exploited by malicious people to conduct cross-site scripting and SQL injection attacks, bypass certain security restrictions, and compromise a vulnerable system.
1) Input passed via the multiple parameters to multiple scripts is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
List of affected scripts and parameters:
<a href="http://[host]/pages/editcirculation.php?sortby
" target="_blank">http://[host]/pages/editcirculation.php?sortby
</a>
<a href="http://[host]/pages/editcirculation.php?language
" target="_blank">http://[host]/pages/editcirculation.php?language
</a>
<a href="http://[host]/pages/editfield.php?fieldid
" target="_blank">http://[host]/pages/editfield.php?fieldid
</a>
<a href="http://[host]/pages/editfield.php?language
" target="_blank">http://[host]/pages/editfield.php?language
</a>
<a href="http://[host]/pages/editfield.php?start
" target="_blank">http://[host]/pages/editfield.php?start
</a>
<a href="http://[host]/pages/editmailinglist_default.php?language
" target="_blank">http://[host]/pages/editmailinglist_default.php?language
</a>
<a href="http://[host]/pages/editmailinglist_default.php?start
" target="_blank">http://[host]/pages/editmailinglist_default.php?start
</a>
<a href="http://[host]/pages/editmailinglist_step1.php?listid
" target="_blank">http://[host]/pages/editmailinglist_step1.php?listid
</a>
<a href="http://[host]/pages/editmailinglist_step1.php?start
" target="_blank">http://[host]/pages/editmailinglist_step1.php?start
</a>
<a href="http://[host]/pages/editslot.php?language
" target="_blank">http://[host]/pages/editslot.php?language
</a>
<a href="http://[host]/pages/editslot.php?slotid
" target="_blank">http://[host]/pages/editslot.php?slotid
</a>
<a href="http://[host]/pages/editslot.php?start
" target="_blank">http://[host]/pages/editslot.php?start
</a>
<a href="http://[host]/pages/editslot.php?templateid
" target="_blank">http://[host]/pages/editslot.php?templateid
</a>
<a href="http://[host]/pages/edittemplate_step1.php?language
" target="_blank">http://[host]/pages/edittemplate_step1.php?language
</a>
<a href="http://[host]/pages/edittemplate_step1.php?start
" target="_blank">http://[host]/pages/edittemplate_step1.php?start
</a>
<a href="http://[host]/pages/edittemplate_step1.php?templateid
" target="_blank">http://[host]/pages/edittemplate_step1.php?templateid
</a>
<a href="http://[host]/pages/showmaillist.php?language
" target="_blank">http://[host]/pages/showmaillist.php?language
</a>
<a href="http://[host]/pages/showmaillist.php?sortby
" target="_blank">http://[host]/pages/showmaillist.php?sortby
</a>
<a href="http://[host]/pages/showmaillist.php?start
" target="_blank">http://[host]/pages/showmaillist.php?start
</a>
<a href="http://[host]/pages/showtemplates.php?sortby
" target="_blank">http://[host]/pages/showtemplates.php?sortby
</a>
<a href="http://[host]/pages/showtemplates.php?start
" target="_blank">http://[host]/pages/showtemplates.php?start
</a>
<a href="http://[host]/pages/showuser.php?sortby
" target="_blank">http://[host]/pages/showuser.php?sortby
</a>
<a href="http://[host]/pages/showuser.php?start
" target="_blank">http://[host]/pages/showuser.php?start
</a>
2) Input passed via multiple parameters to multiple scripts is not properly sanitised before being used in an SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
List of affected scripts and parameters:
<a href="http://[host]/pages/editslot.php?slotid
" target="_blank">http://[host]/pages/editslot.php?slotid
</a>
<a href="http://[host]/pages/edittemplate_step2.php?templateid
" target="_blank">http://[host]/pages/edittemplate_step2.php?templateid
</a>
<a href="http://[host]/pages/editmailinglist_step2.php?templateid
" target="_blank">http://[host]/pages/editmailinglist_step2.php?templateid
</a>
3) The application does not restrict access to the pages/writeuser.php script and can be exploited to add an administrative application user.
4) The pages/restart_circulation_values_write.php, pages/editcirculation_write.php, and pages/restart_circulation_write.php scripts allow the upload of files with arbitrary extensions to a folder inside the webroot. This can be exploited to execute arbitrary PHP code by uploading a malicious PHP script.
The vulnerabilities are confirmed in version 2.11.2. Other versions may also be affected.
|
