Thema: Joomla CKForms Component Multiple Vulnerabilities

TITLE:
Joomla CKForms Component Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA40127

DESCRIPTION:
Secunia Research has discovered some vulnerabilities in the CKForms
component for Joomla, which can be exploited by malicious people to
conduct SQL injection attacks and compromise a vulnerable system.

1) Input passed via the "articleid" parameter to index.php (when
"option" is set to "com_ckforms", "view" is set to "ckforms", "task"
is set to "send", and "id" is set to a valid form id) is not properly
sanitised before being used in a SQL query. This can be exploited to
manipulate SQL queries by injecting arbitrary SQL code.

Successful exploitation requires that the "Save result" is enabled in
the form's configuration (disabled by default).

2) Input passed via the "sortd" parameter to index.php (when "option"
is set to "com_ckforms", "view" is set to "ckformsdata", "layout" is
set to "data", and "id" is set to "f") is not properly sanitised
before being used in a SQL query. This can be exploited to manipulate
SQL queries by injecting arbitrary SQL code.

3) The "CkformsModelCkforms::saveData()" method in models/ckforms.php
allows uploading of files with arbitrary extensions to a folder inside
the web root. This can be exploited to execute arbitrary PHP code by
uploading a PHP file.

Successful exploitation requires the "fileupload" field to be
configured.

NOTE: The stored file name is based on the original file name and a
time stamp, which is predictable.

The vulnerabilities are confirmed in version 1.3.4. Other versions
may also be affected.

SOLUTION:
Edit the source code to ensure that input is properly sanitised.
Change the "Uploaded files path" setting to a directory outside of
the web root.

PROVIDED AND/OR DISCOVERED BY:
Secunia Research

ORIGINAL ADVISORY:
Secunia Research:
http://secunia.com/secunia_research/2010-81/
http://secunia.com/secunia_research/2010-82/

OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/

DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/

EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/

EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/

EXPLOIT:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.

Kurz zusammengefaßt: Die Komponente CKForms (1.3.4 und früher) enthält eine gewichtige Sicherheitslücke, derowegen du diese Komponente nicht einsetzen solltest.

Danke für den Hinweis. Wieso steht dieser Hinweis aber noch nicht in dieser Liste?
http://docs.joomla.org/Vulnerable_Extensions_List

Zitat von jdgf

Danke für den Hinweis. Wieso steht dieser Hinweis aber noch nicht in dieser Liste?
http://docs.joomla.org/Vulnerable_Extensions_List

im Link:

November 2009 Compiled Vulnerability Reports.

Zitat von adi

So wie ich das verstehe sollte die Version 1.3.4 gefixt sein.

Es handelt sich um eine andere Lücke als die, die gefixt wurde.

The vulnerabilities are confirmed in version 1.3.4. Other versions
may also be affected.

Zitat von adi

Hier Massnahmen die man vornehmen sollte, wenn man nicht auf CKForms verzichten möchte:

siehe hier: http://secunia.com/advisories/40127/

Lösung:
Edit the source code to ensure that input is properly sanitised. Change the "Uploaded files path" setting to a directory outside of the web root.

Gruss

Adi

...und wie oder wo ändert man den Quellcode damit die Daten in ein anderes Verzeichnis gespeichert werden?
Danke