Multiple input verification vulnerability in phpmyfamily

Multiple input verification vulnerability in phpmyfamily

Release date: 2010-09-17
Updated on: 2010-09-19

Affected Systems:
Phpmyfamily 1.4.2
Description:
--------------------------------------------------------------------------------
Bugtraq id: 43293

Phpmyfamily is a dynamic genealogy Web site building tool that allows geographically dispersed family members to collaborate and share research.

Multiple input verification errors exist in phpmyfamily. Remote attackers can execute SQL injection, XSS, directory traversal, cross-site request forgery, and other attacks by submitting malicious parameter requests.

1) not properly filtered and submitted to inc/passwdform. inc. submit the reason parameter of the php script to mail. php script referer parameters and submit to track. the person parameter of the php script is returned to the user, which may cause cross-site scripting attacks.

2) phpmyfamily allows users to perform certain operations through HTTP requests without performing a validity check, which may cause cross-site request forgery attacks.

3) When func is set to email, phpmyfamily does not properly filter the pwdEmail parameter submitted to my. php, which may cause SQL injection attacks.

4) when action is set to unsub and person is set, phpmyfamily does not properly filter the email parameters submitted to track. php, which may cause SQL injection attacks.

5) When func is set to delete, area is set to transcript, and person is set, phpmyfamily does not properly filter and submit to passthru. php transcript parameter, which may cause SQL injection or directory traversal attacks.

<* Source: Abysssec

Link: http://secunia.com/advisories/41449/
Http://www.exploit-db.com/exploits/15029/
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

Http://site.com/phpmyfamily/admin/
Http://site.com/phpmyfamily/docs/
Http://site.com/phpmyfamily/images/
Http://site.com/phpmyfamily/inc/
Http://site.com/phpmyfamily/lang/
Http://site.com/phpmyfamily/styles/
Document. write ("http://SITE.com/phpmyfamily/inc/passwdform.inc.php? Reason = <script> document. write (" ") </script>
Document. write ("http://SITE.com/phpmyfamily/census.php? Ref = <script> document. write (" ") </script>
Http://SITE.com/phpmyfamily/mail.php? Referer = <script code>
Http://SITE.com/phpmyfamily/track.php? Person = <script code>
">