[Bkis-01-2010] Multiple Vulnerabilities in BigAce - Bkis

Multiple Vulnerabilities in BigAce

1. General Information

BigAce is a free content management software (CMS) written in PHP, and is
available at http://www.bigace.de. In April 2010, Bkis Security discovered
an XSS and CSRF vulnerability in BigAce 2.7.1. Taking advantage of this
vulnerability, hacker is able to insert pieces of code into the path's
link to execute in users' browser, leading to the loss of cookies and
session. Hacker can also trick users into manipulating some of the
system's functions without users' awareness.

Bkis has informed the software developer team, and they have patched the
vulnerability in the latest software version - BigAce 2.7.2.

Details: http://security.bkis.com/multiple-vulnerabilities-in-bigace-5/
SVRT Advisory: Bkis-01-2010
Initial vendor notification: 04/26/2010
Release Date: 05/22/2010
Update Date: 05/22/2010
Discovered by: Truong Thao Nguyen
Attack Type: XSS, CSRF
Security Rating: High
Impact: Code Execution
Affected Software: BigAce (version <= 2.7.1)

2. Technical Description

The XSS vulnerability of the software was found in the following modules:

• Create category
• Create Style sheet
• Create Template
• Edit template
• Create Group
• New permission
• Create new configuration
• Comunties

Because the input variants of this function are not carefully checked and
filtered, hacker is able to insert pieces of code into the path's link.
When users sign in and click this link, the malicious code (JavaScript)
will be executed, and users may lose their cookies, session, etc.

The CSRF vulnerability of the software was found in the following modules:

• Delete category
• Delete style sheet
• Delete template
• Delete layout
• Delete group
• Active Permission
• Active Modules

Because a task performance process is not authenticated, users can be
tricked into manipulating a task without awareness. Thus, hacker is able
to perform his malicious tricks via a legitimate user.

3. Solution
   Bkis recommends all organizations and individuals who are using BigAce to
   immediately update the latest software version.
   Download: http://www.bigace.de/BIGACE-2.7.2.html

4. About Bkis
   Bkis is Vietnamese leading Company in researching, deploying network
   security software and solutions.
   Official website: http://www.bkis.com
   Blog: http://blog.bkis.com and http://security.bkis.com