GulfTech Computers - Professional Computer Services  
Additional Links
-> Dicussion Forum
-> Encryption Tools
-> Information Tools
-> Net Info Tools
-> Latest Advisories
-> Latest Vulns
-> Latest Win Software
-> Latest Nix Software
-> Security News
-> Security Press
Recent News

GulfTech Computers strives to beat the price(s) of any other business around. Check with us first as it just may save you some time and money. And who doesn't want to save money? Please contact us with any questions or inquiries.

Latest GulfTech Releases

SubScan v1.2 Scans a domain for DNS records and SubDomains. Very stealthy, and can be used to find many hosts not on the public netblock. A very interesting tool to say the least. Works on both Nix and Windows based systems. Get it now!

Download SubScan v1.2

Search GulfTech
You can use the form below to search our site. Just enter the keyword or keywords to search.
Latest Advisories
SCO Security Advisory - OpenServer 5.0.6 OpenServer 5.0.7 : uudecode does not check for symlink or pipe (SCOSA-2004.7)
SCO Security Advisory - OpenServer 5.0.6 OpenServer 5.0.7 : OpenSSL Multiple Vulnerabilities (SCOSA-2004.10)
SCO Security Advisory - OpenServer 5.0.6 OpenServer 5.0.7 : Xsco contains a buffer overflow that could be exploited to gain root privileges (SCOSA-2004.3)
SCO Security Advisory - UnixWare 7.1.3 Open UNIX 8.0.0 : Xsco contains a buffer overflow that could be exploited to gain root privileges. (SCOSA-2004.2)
Microsoft Security Bulletin Re-release, August 2004
Latest Vulnerabilities
OpenFTPD Format String Vulnerability
Fusion News Unauthorized Account Addition Vulnerability
Jaws 0.4 Authentication Bypass Vulnerability
DansGuardian Hex Encoding URL Banned Extension Filter Bypass Vulnerability
LostBook v1.1 Javascript Execution Vulnerability
Latest Security News
Anti-spam spamvertisers agree to quit
Black Hat day 2 sounds security alarm
VPNs (Virtual Private Nightmares)
HNS Newsletter issue 224 has been released
Long-awaited IE patch (finally) arrives















Multiple MetaDot Vulnerabilities
January 12, 2022


Vendor : Metadot Corporation
URL : http://www.metadot.com
Version : MetaDot Portal 5.6.5.4b5 && Earlier [ All Versions ]
Risk : Multiple Vulnerabilities


Description:
Metadot is a popular open source portal software (GPL) recognized for its revolutionary ease-of-use. It provides content management like file, page and link management, collaboration features like discussion forums and polls and personalization like My Yahoo. It is powered by Perl && MySQL. Users range from home users to government, banks, universities and even NASA ;)


SQL Injection Vulnerability:
It may be possible for an attacker to influence SQL queries by passing unexpected data to certain variables including the "id" and "key" variable. Even if an attacker is not successful with influencing an SQL query he can cause the outputted error message to execute script into an unsuspecting users browser thus causing a Cross Site Scripting attack. Also, the SQL error messages reveal a great deal of data about the server. Below is an example error message. The URI used to create this error was index.pl?isa=Session&op;=auto_login&new;_user=&key;='[Problem]

--[ Begin Error Message ]--------------------------------------------------------------------

sqlSelect: SQL statement:

SELECT userid, lastonline, sessioninfo FROM sessions WHERE sessionid=''[Problem]' Error: You have an error in your SQL syntax near '[Problem]' ' at line 1 at /home/sharem/metadot/metadot/index.pl

DBAccess::DBIObj::sqlSelect('DBAccess::MySQL=HASH(0x85de6a8)', 'userid, lastonline, sessioninfo', 'sessions', 'sessionid=\'\'[Problem]\'') called at /home/sharem/metadot/metadot/DBAccess.pm line 129 DBAccess::sqlSelect('DBAccess', 'userid, lastonline, sessioninfo', 'sessions', 'sessionid=\'\'[Problem]\'') called at /home/sharem/metadot/metadot/Session.pm line 508 Session::_initialize('Session=HASH(0xb1be85c)', '\'[Problem]') called at /home/sharem/metadot/metadot/Session.pm line 161 Session::restore('Session', '\'[Problem]') called at /home/sharem/metadot/metadot/Metadot/SessionHandler/CookieSessionHandler.pm line 97 Metadot::SessionHandler::CookieSessionHandler::restore_session('Metadot::SessionHandler:: CookieSessionHandler=HASH(0x8c443f8)', '\'[Problem]')called at /home/sharem/metadot/metadot/Metadot/ Authenticator.pm line 63 Metadot::Authenticator::authenticate('Metadot::Authenticator::UserPassAuthenticator =HASH(0x9d34338)') called at /home/sharem/metadot/metadot/Portal.pm line 3863 Portal::_web_init('Portal =HASH(0xb4c271c)') called at /home/sharem/metadot/metadot/Metadot/Implementations/Portal/Default.pm line 52 Metadot::Implementations::Portal::Default::initialize('Metadot::Implementations::Portal::Default', 'Portal =HASH(0xb4c271c)') called at /home/sharem/metadot/metadot/Portal.pm line 2830 Portal::_initialize('Portal =HASH(0xb4c271c)') called at /home/sharem/metadot/metadot/Portal.pm line 160 Portal::new('Portal', 1) called at /home/sharem/metadot/metadot/index.pl line 43 Apache::ROOT::metadot::index_2epl::handler('Apache=SCALAR (0xb421470)') called at /usr/local/lib/perl5/site_perl/5.6.1/i686-linux/Apache/Registry.pm line 149 eval {...} called at /usr/local/lib/perl5/site_perl/5.6.1/i686-linux/Apache/Registry.pm line 149 Apache::Registry ::handler('Apache=SCALAR(0xb421470)') called at /dev/null line 0 eval {...} called at /dev/null line 0

---------------------------------------------------------------------------------------------

Below are some examples URI's that will allow an attacker to influence queries, gather info or XSS.

/index.pl?id=[Evil_Query]
/index.pl?iid=[Evil_Query]
/index.pl?isa=Session&op;=auto_login&new;_user=&key;=[Evil_Query]


Information Disclosure && Path Disclosure:
There is a great deal of information given up by interrupting the SQL query, but can also be caused in other ways than the previously mentioned. Lets look at /index.pl?iid=[ValidID]&isa;=Discussion&op;= Where [ValidID] is should be a valid id number such as 1000 or whatever it may be.

--[ Begin Error Message ]--------------------------------------------------------------------

Software error: must provide operation name at /home/sharem/metadot/metadot/Auditable.pm line 196 Auditable::is_allowed_to_do('Discussion=HASH(0xae19218)', '', 'Metadot::User::FlexUser=HASH(0xb414f70)', 1) called at /home/sharem/metadot/metadot/index.pl line 232 Apache::ROOT::metadot::index_2epl::handler ('Apache=SCALAR(0xacf893c)') called at /usr/local/lib/perl5/site_perl/5.6.1/i686-linux/Apache/Registry.pm line 149 eval {...} called at /usr/local/lib/perl5/site_perl/5.6.1/i686-linux/Apache/Registry.pm line 149 Apache::Registry::handler('Apache=SCALAR(0xacf893c)') called at /dev/null line 0 eval {...} called at /dev/null line 0

---------------------------------------------------------------------------------------------

As you can see that will give you the server path, perl version and several other interesting bits of information. Path can also be disclosed by a bogus value in the "isa" variable. /index.pl?isa=blah


Cross Site Scripting:
Cross Site Scripting: There are a number of potential cross site scripting issues in MetaDot. Below are some examples

/index.pl?isa=XSS<iframe%20src=http://www.gulftech.org>
/userchannel.pl?id=435&isa;=NewsChannel&redirect;=1&op;="><iframe>
/index.pl?iid='"><iframe%20src=http://www.gulftech.org>


Solution:
The MetaDot team have addressed this issue and an update was supposed to be released on Thursday the 8th of January. Users of the MetaDot portal system are encouraged to upgrade immediately. Users can get the necessary security fixes provided by MetaDot Corporation at the link below.

http://www.metadot.com/metadot/index.pl?iid=2632&isa;=Category


Timeline:
12/12/2021 - Discovered Vulnerabilities
12/13/2003 - Contacted MetaDot Corporation
12/14/2003 - Received Vendor Response
01/07/2022 - Decided Proper Disclosure Date With Vendor
01/08/2021 - Patch Publicly Available
01/12/2021 - Details Will Be Made Public


Credits:
Credits go to JeiAr of the GulfTech Security Research Team.






© Copyright 2002 - GulfTech Computers, All Rights Reserved
Contact GulfTech Computers