SQL Injection within popular Magento blog extension (CVE-2015-3428)

Background
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

The aheadWorks Blog extension for Magento prior to version 1.3.10 is vuln=
erable to a critical SQL Injection security flaw. A remote unauthenticate=
d attacker could exploit this vulnerability to take complete control of t=
he affected Magento server and database. With almost 80,000 downloads at =
the time of writing, the affected component is the most popular blog comp=
onent available via Magento Connect.

Advisory Link:	http://appcheck-ng.com/critical-security-flaw-patched-in-m=
agento-blog-extension-cve-2015-3428/
Vendor Link:	http://www.magentocommerce.com/magento-connect/blog-communit=
y-edition-by-aheadworks.html


Technical Details
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

The SQL Injection flaw was discovered using the AppCheck NG scanner durin=
g preparation for a security seminar. The exercise involved configuring s=
everal popular CMS platforms including WordPress, Joomla, Drupal and Mage=
nto along with the most popular plugins available at the time for each pl=
atform.

A default AppCheck NG scan was then performed against each system to demo=
nstrate our ability to discover previously undisclosed security flaws usi=
ng AppCheck NG. Among the discovered vulnerabilities was a Blind SQL Inje=
ction flaw within the aheadWorks Blog extension component. AppCheck was a=
ble to identify the flaw by triggering a measurable time delay using the =
MySQL "SLEEP()" function.=20

For example, the following URI will trigger a 10 second time delay when a=
ccessed using a web browser:

=09http://magento_site/blog?dir=3Ddesc&order=3Duser AND 1=3D((SELECT 1 FR=
OM (SELECT SLEEP(10))A)) OR 1234=3D4321

Compared the following URI that will trigger a 2 second delay:

=09http://magento_site/blog?dir=3Ddesc&order=3Duser AND 1=3D((SELECT 1 FR=
OM (SELECT SLEEP(2))A)) OR 1234=3D4321

AppCheck NG employs a range of methods to detect blind SQL injection incl=
uding time delay inference. Each suspected flaw is confirmed through 15 v=
alidation cycles to eradicate false positives.

Exploit
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

The attacker could easily exploit this flaw using publicly available expl=
oit tools such as sqlmap (http://sqlmap.org/). By extracting the username=
=20and hashed password from the admin_user table, it is possible to obtai=
n Magento administrator credentials via an offline attack. A demonstratio=
n of this flaw is performed at our free application security seminar. See=
=20the following URL for our next event: http://appcheck-ng.com/events/

Solution
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

This flaw was reported to aheadWorks on the 22nd of April 2015, a fix was=
=20made available on the 27th of May 2015 and can be downloaded via Magen=
to Connect.
=A0
=A0
=A0

***



This list is sponsored by Cenzic
--------------------------------------
Let Us Hack You. Before Hackers Do!
It's Finally Here - The Cenzic Website HealthCheck. FREE.
Request Yours Now! 
http://www.cenzic.com/2009HClaunch_Securityfocus
--------------------------------------