0day.today - أكبر قاعدة بيانات للثغرات في العالم.
![](/img/logo_green.jpg)
We use one main domain DOMAIN_LINK
If you want to purchase the exploit or pay for service, you need to buy Gold. We don't want you to use our site as a tool for hacking purposes, so any kind of action that could affect illegaly other users or websites that you don't have right to access will be banned and your account including your data will be destroyed.
Administration of this site uses the official contacts. Beware of impostors!
![We DO NOT use Telegram or any messengers / social networks!](/img/no_telegram_big.png)
Please, beware of scammers!
- Read the [ agreement ]
- Read the [ أرسل ] rules
- Visit the [ الأسئلة الشائعة ] page
- [ Register ] profile
- Get [ الذهب ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ [email protected] ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
يمكنكم الاتصال بنا من خلال:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
TYPO3 Extension ke_questionnaire 2.5.2 Information Disclosure Vulnerability
المؤلف
الخطر
![](/img/risk/critlow_2.gif)
Security Risk Medium
]0day-ID
الصنف
تاريخ الإضافة
CVE
المنصة
Information Disclosure in TYPO3 Extension ke_questionnaire The TYPO3 extension ke_questionnaire stores answered questionnaires in a publicly reachable directory on the webserver with filenames that are easily guessable. Details ======= Product: ke_questionnaire Affected Versions: 2.5.2 (possibly all versions) Fixed Versions: unknown Vulnerability Type: Information Disclosure Security Risk: medium Vendor URL: http://kequestionnaire.kennziffer.com/ Vendor Status: notified Advisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2014-009 Advisory Status: published CVE: CVE-2014-8874 CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8874 Introduction ============ "The TYPO3 extension kequestionnaire allows to easily and quickly create and evaluate individual questionnaires online in any TYPO3 website." (translated from the official website of ke_questionnaire) More Details ============ Files containing the answered questionnaires are stored in the "typo3temp" directory within the TYPO3 installation. As the source code of the ke_questionnaire extension shows, the filename of an answered questionnaire is solely based on the questionnaire ID and the user ID of the user who created the questionnaire. Source code (shortened): ------------------------------------------------------------------------------ function init() { global $BE_USER,$LANG,$BACK_PATH,$TCA_DESCR,$TCA,$CLIENT,$TYPO3_CONF_VARS; $this->temp_file = \ 'tx_kequestionnaire_temp_'.$this->q_id.'_'.$GLOBALS['BE_USER']->user['uid']; [...] } [...] function createSchedulerTask(){ $myVars = $GLOBALS['BE_USER']->getSessionData('tx_kequestionnaire'); $file_path = PATH_site.'typo3temp/'.$this->temp_file; [...] } ------------------------------------------------------------------------------ A valid URL that returns the answers to a questionnaire could look like the following: http://www.example.com/typo3temp/tx_kequestionnaire_temp_15999_7 Proof of Concept ================ Using the tool wfuzz[1] it is possible to search for answers to questionnaires on a TYPO3 site that employs ke_questionnaire: ------------------------------------------------------------------------ $ python wfuzz.py -c -z range,14000-15000 -z range,1-10 --hc 301 \ http://example.com/typo3temp/tx_kequestionnaire_temp_FUZZ_FUZ2Z ------------------------------------------------------------------------ Workaround ========== The webserver config should deny access to answered questionnaire files, for example by adding an .htaccess file that limits access to tx_kequestionnaire_* files (this may hinder online evaluation of the questionnaires). Fix === No official fix available. Security Risk ============= Depending on the questions in the questionnaire the answered questionnaires may contain personal information including participants' full names, addresses and so on. The risk therefore strongly depends on the information supplied in the questionnaires. Since this information will at least often contain email addresses, it is rated as at least a medium risk. Timeline ======== 2014-04-21 Vulnerability identified 2014-04-30 Customer approved disclosure to vendor 2014-05-13 Vendor notified 2014-05-20 Vendor works with TYPO3 security team on a fix 2014-06-15 Vendor releases updated version which according to them does not fix the issue 2014-10-08 TYPO3 security team says the issue is still unresolved 2014-11-04 Vendor continues to release updated versions, no response whether the security issue is fixed 2014-11-14 CVE number assigned 2014-12-01 Advisory released References ========== [1] https://code.google.com/p/wfuzz/ # 0day.today [2024-06-28] #