[KIS-2013-10] openSIS <= 5.2 (ajax.php) PHP Code Injection Vulnerability

2013-12-0900:00:00

vulners.com

JSON

openSIS <= 5.2 (ajax.php) PHP Code Injection Vulnerability

[-] Software Link:

http://www.opensis.com/

[-] Affected Versions:

All versions from 4.5 to 5.2.

[-] Vulnerability Description:

The vulnerable code is located in the /ajax.php script:

if(clean_param($_REQUEST['modname'],PARAM_NOTAGS))
{

   if&#40;$_REQUEST[&#39;_openSIS_PDF&#39;]==&#39;true&#39;&#41;

```
       ob_start&#40;&#41;;
```

   if&#40;strpos&#40;$_REQUEST[&#39;modname&#39;],&#39;?&#39;&#41;!==false&#41;

```
   {
```

       $vars = substr&#40;$_REQUEST[&#39;modname&#39;],&#40;strpos&#40;$_REQUEST[&#39;modname&#39;],&#39;?&#39;&#41;+1&#41;&#41;;

       $modname = substr&#40;$_REQUEST[&#39;modname&#39;],0,strpos&#40;$_REQUEST[&#39;modname&#39;],&#39;?&#39;&#41;&#41;;

       $vars = explode&#40;&#39;?&#39;,$vars&#41;;

```
       foreach&#40;$vars as $code&#41;
```
```
       {
```

           $code = decode_unicode_url&#40;&quot;&#92;$_REQUEST[&#39;&quot;.str_replace&#40;&#39;=&#39;,&quot;&#39;]=&#39;&quot;,$code&#41;.&quot;&#39;;&quot;&#41;;

```
           eval&#40;$code&#41;;
```
```
       }
```
```
   }
```

User input passed through the "modname" request variable is not properly sanitized before being used in
a call to the eval() function at line 99. This can be exploited to inject and execute arbitrary PHP code.

[-] Solution:

As of December 5th, 2013 the only solution is this patch: http://sourceforge.net/p/opensis-ce/code/1009

[-] Disclosure Timeline:

[04/12/2012] - Issue reported to http://sourceforge.net/p/opensis-ce/bugs/59/
[28/12/2012] - Vendor contacted, replied that the next version will fix the issue
[12/01/2013] - CVE number requested
[14/01/2013] - CVE number assigned
[26/04/2013] - Version 5.2 released, however the issue isn't fixed yet
[12/05/2013] - Vendor contacted again
[15/05/2013] - Issue temporarily fixed in the SVN repository (r1009)
[04/12/2013] - After one year still no official solution available

[-] CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2013-1349 to this vulnerability.

[-] Credits:

Vulnerability discovered by Egidio Romano.

[-] Original Advisory:

http://karmainsecurity.com/KIS-2013-10