[Bkis-01-2010] Multiple Vulnerabilities in BigAce
BigAce is a free content management software (CMS) written in PHP, and is available at http://www.bigace.de. In April 2010, Bkis Security discovered an XSS and CSRF vulnerability in BigAce 2.7.1. Taking advantage of this vulnerability, hacker is able to insert pieces of code into the path’s link to execute in users’ browser, leading to the loss of cookies and session. Hacker can also trick users into manipulating some of the system’s functions without users’ awareness.
Bkis has informed the software developer team, and they have patched the vulnerability in the latest software version - BigAce 2.7.2.
Details: http://security.bkis.com/multiple-vulnerabilities-in-bigace-5/
SVRT Advisory: Bkis-01-2010
Initial vendor notification: 04/26/2010
Release Date: 05/22/2010
Update Date: 05/22/2010
Discovered by: Truong Thao Nguyen
Attack Type: XSS, CSRF
Security Rating: High
Impact: Code Execution
Affected Software: BigAce (version <= 2.7.1)
The XSS vulnerability of the software was found in the following modules:
Because the input variants of this function are not carefully checked and filtered, hacker is able to insert pieces of code into the path’s link. When users sign in and click this link, the malicious code (JavaScript) will be executed, and users may lose their cookies, session, etc.
The CSRF vulnerability of the software was found in the following modules:
Because a task performance process is not authenticated, users can be tricked into manipulating a task without awareness. Thus, hacker is able to perform his malicious tricks via a legitimate user.
Solution
Bkis recommends all organizations and individuals who are using BigAce to immediately update the latest software version.
Download: http://www.bigace.de/BIGACE-2.7.2.html
About Bkis
Bkis is Vietnamese leading Company in researching, deploying network security software and solutions.
Official website: http://www.bkis.com
Blog: http://blog.bkis.com and http://security.bkis.com
Bui Quang Minh
Manager - Vuln Team - Bkis Security - Bkis
Do your best, the rest will come !
Hay lam vi?c h?t minh, nh?ng di?u t?t d?p s? d?n v?i b?n!
Disclaimer: This e-mail and any files transmitted with it are confidential and may contain privileged information. It is intended solely for the use of the individual to whom it is addressed and others authorized to receive it. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. If you have received this message in error, please notify the sender immediately by reply e-mail and delete completely this e-mail from your system, without reproducing, distributing or retaining copies.