Category: Uncategorized

//=============================
// Shane Dempsey
// Managing Director,
// Gaisan Technologies Ltd.
// e: sdempsey@gaisan.com
// u: http://www.gaisan.com
// t: +353 (0)51 304224
//=============================

—–Original Message—–
From: Shane Michael Dempsey [mailto:sdempsey@gaisan.com]
Sent: 06 December 2005 10:57
To: ‘whayes@gaisan.com’
Subject: what happened on taht site

Here’s the exploit..

PROGRAM: Moregroupware
HOMEPAGE: http://www.moregroupware.com/
VULNERABLE VERSIONS: 0.6.7 and prior ?
RISK: Low/Medium
IMPACT: Cross Site Scripting
RELEASE DATE: 2003-06-26

=================================================
TABLE OF CONTENTS
=================================================

1………………………………………………….DESCRIPTION
2……………………………………………………..DETAILS
3…………………………………………………….EXPLOITS
4……………………………………………………SOLUTIONS
5…………………………………………………..WORKAROUND
6…………………………………………..DISCLOSURE TIMELINE
7……………………………………………………..CREDITS
8…………………………………………………..DISCLAIMER
9…………………………………………………..REFERENCES
10……………………………………………………FEEDBACK

1. DESCRIPTION
=================================================

“Some of the features that are worth being mentioned:

– Contact/address management
– Webmail
– full-featured Calendar
– ToDo management
– News
– Project management
– Some preferences for each module
– Skins based on Cascading Style Sheets”

(direct quote from http://www.moregroupware.com)

2. DETAILS
=================================================

– Cross Site Scripting :

Many exploitable bugs was found in Moregroupware which cause script
execution on client’s computer.

This kind of attack known as “Cross-Site Scripting Vulnerability”
is present in many section of the web site, an attacker can input
specially crafted links and/or other malicious scripts.

– Upload files :

When you upload a file on the server you can upload some html files or
php files. You can grab or change some informations with this
possibility.

3. EXPLOIT
=================================================

– Cross Site Scripting (many pages are infected) :

http://[target]/moregroupware/modules/contact/index.php?

You can add a contact and put , alert(); can be
replaced by a malicious script.

A dialog box is opened on the client browser.

Impact is relatively low, as this is a closed group application.
People having access should be ‘trustable’.

– Upload files :

You can upload a file like file.php:

And access it directly :
http://[target]/moregroupware/modules/files/store/file.php

This file is executed on the server and the information is divulged
to the hacker.

4. SOLUTIONS
=================================================

– Cross Site Scripting :
Use the function php eregi_replace to filter the input data.

5. WORKAROUND
=================================================

– Upload files :
Secure this module by replacing file extension or specify to the web
server not to execute this files. A better way for this problem is
to set permissions on the store/directory so that only the webserver can
read the files. A simple fix that actually works.

this wasn’t done…

6. DISCLOSURE TIMELINE
=================================================

06/20/2003 Vendor notified
06/24/2003 Response from the vendor and corrections added
06/25/2003 Security Corporation clients notified
06/26/2003 Public disclosure

7. CREDITS
=================================================

Discovered by Fran?ois SORIN

8. DISLAIMER
=================================================

The information within this paper may change without notice. Use of
this information constitutes acceptance for use in an AS IS condition.
There are NO warranties with regard to this information. In no event
shall the author be liable for any damages whatsoever arising out of
or in connection with the use or spread of this information. Any use
of this information is at the user’s own risk.

9. REFERENCES
=================================================

– http://www.security-corporation.com/articles-20030626-003.html

In Hindusim a Dharma outlines a lawful or just way of living.
http://en.wikipedia.org/wiki/Dharma

Dharma (sanskrit, roughly law or way) is the way of the higher Truths.
Beings that live in harmony with Dharma proceed quicker towards moksha,
nirvana, or personal liberation, and as such Dharma forms the basis for
philosophies, beliefs and practices originating in India. The oldest of
these, is in fact more properly known as Sanatana Dharma or Eternal Dharma,
otherwise referred to as Hinduism. Buddhism, Jainism and Sikhism also retain
the centrality of Dharma. For the followers of these traditions, Dharma also
refers to the teachings and doctrines of their founder, such as Gautama
Buddha or Mahavira Jain. As the religious and moral doctrine of the rights
and duties of each individual, Dharma therefore can generally refer to
religious duty, as also mean social order, right conduct, or simply virtue.

LOVE BEAR,

…shane XXX

Absolutely brilliant…

http://etext.lib.virginia.edu/cgi-local/DHI/dhi.cgi?id=dv3-01

love,

…shane
The

Jurisprudence is the scientific study of law through a philosophical lens.
The aim of jurisprudence is to critically analyze the purpose and
application of the law. It is a historical, social, and cultural movement
with the inherent contradiction that analysis of the law and understanding
of its politics will unravel and reveal the ‘truth’ behind legal reasoning
and the exercise of legal power, even while at the same time admitting there
is no such thing. It is hoped through legal scholarship that a deeper
understanding of the law and the relationships of power it constructs can
better society by enabling jurists to predict what the law is and what it
ought to be given its unpredictable and uncertain nature.

//=============================
// Shane Dempsey
// Managing Director,
// Gaisan Technologies Ltd.
// e: sdempsey@gaisan.com
// u: http://www.gaisan.com
// t: +353 (0)51 304224
//=============================