|
e107 "rate.php" Redirection and Multiple Rating Weakness
|
|
Secunia Advisory:
|
SA17890
|
|
|
Release Date:
|
2005-12-05
|
|
Last Update:
|
2006-01-13
|
|
Popularity:
|
6,243 views
|
|
|
Critical:
|
Not critical
|
|
Impact:
|
Security Bypass
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| Software: | e107 0.x
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
| CVE reference: | CVE-2005-4052
|
|
Description:
Marc Ruef has reported two weakness in e107, which potentially can be exploited by malicious users to bypass certain security restrictions and by malicious people to conduct phishing attacks.
1) A design error exists in the way e107 uses an unverified user supplied argument to redirect a user after the user has submitted a file download rating. This can be exploited e.g. by tricking a user into following a specially crafted HTML link to a trusted site's e107's "rate.php" script. The user will be redirected to the untrusted (fake) site when he clicks on the link.
Example:
http://[host]/rate.php?download^2^[url]^1
Successful exploitation requires that the user has already logon to e107.
2) A design error exists in the way e107 tries to prevent a user from submitting multiple ratings for a file download. This can be exploited by malicious users to bypass the restriction and submit multiple votes.
The weaknesses have been confirmed in version 0.6174. Other versions may also be affected.
Solution:
Update to version 0.6175.
http://sourceforge.net/project/showfiles.php?group_id=63748
Provided and/or discovered by:
Marc Ruef
Changelog:
2005-12-23: Updated "Solution" section.
2006-01-13: Added CVE reference.
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
